EX-ARRR: Sailing the 0-click Seas

ironpeak.be ·2026-09-27

Apple faces a zero-click security threat due to a parser bug in its EXR image format decoder. This bug allows attackers to overwrite 800 kilobytes of memory without any user interaction. Apple's EXR decoder allocates a buffer for RGB images but writes RGBA data, causing a four-byte overrun per pixel. The overflow contains attacker-controlled values, making it a serious zero-click vulnerability. The format is rarely scrutinized, making it an ideal target for attackers.

Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at ironpeak.be →

More in Tech

CBN data localisation raises skills, security concerns

Experts say Nigeria has enough data-centre capacity for the CBN’s data localisation rule but warn of skills shortages and fibre security risks. Read More: https://punchng.com/cbn-data-localisation-raises-skills-security-concerns/

2026-09-27 ·punchng.com

PalmPay introduces extra verification for night transfers

Fintech company PalmPay has launched NightGuard, a new security feature that adds an extra verification step for transfers made during selected night hours Read More: https://punchng.com/palmpay-introduces-extra-verification-for-night-transfers/

2026-09-27 ·punchng.com

DIGITAL SOVEREIGNTY: State IT agency faces fork in the road on rehabilitation journey

The State Information Technology Agency can finally set a strategy and follow through on the communications minister’s mandate to improve the citizen experience of government.

2026-09-27 ·dailymaverick.co.za

Week 15 of #100DaysOfCode: 100 Days of Learning, Building, and Becoming a Better Engineer

Introduction About 100 days ago, I reached out to my mentor because I was confused about my career and wasn't really sure what direction I was heading in.

2026-09-27 ·dev.to

JavaScript Concepts I Wish I Understood Earlier: Event Bubbling & Event Delegation

"With AI writing the code, maybe it's time we finally understand what the code is doing." 😅 The rise of AI has made writing code easier than ever.

2026-09-27 ·dev.to

Your Agent Saved the File. Who Checked the Result?

The tool call succeeds. The file exists. The agent says, “Done.” Then someone opens it and finds the wrong total. Nothing crashed. The system answered a smaller question than the customer asked. “Did the file write finish?” and “Does the delivered report meet the request?” are different checks.

Verification tool checks report ID, revision number, item quantities, and total units
JavaScript code computes SHA256 hash and parses file as JSON
Verification ensures row validity, unique item names, and correct totals

2026-09-27 ·dev.to