Binance Warns of Unpatched iOS Sandbox Escape worse_query Exposing Crypto Wallet Keys on iOS 26 and 27

Binance has issued a security advisory about an iOS sandbox escape vulnerability called worse_query that enables malicious apps to read files from other applications, including crypto wallets containing seed phrases, private keys, and credentials. The proof-of-concept exploit, published by researcher forcequit on GitHub, works on iPhones running iOS 26 and iOS 27 without requiring a jailbreak or kernel exploit. Apple's recent updates for iOS 26.7.3 and iOS 27.2.1, released yesterday, do not address the issue according to the official security notes. Apps built on the exploit, such as the WQ Files file manager by developer Christoph Kolbicz, can be installed via sideloading tools like AltStore and SideStore that automatically configure the required App Group container. Binance advises users to remove any sideloaded or untrusted apps, update all software, and move funds to a new wallet on a clean device if a breach is suspected. Neither Apple nor the researcher has confirmed any in-the-wild attacks or thefts involving the vulnerability.

The Hacker NewsNovember 10, 2026Translated from English

Read at source

Binance has issued a public warning about an iOS sandbox escape vulnerability that could allow malicious applications to access sensitive data from other apps, including cryptocurrency wallet seed phrases, private keys, and login credentials.

The exploit, named worse_query and released by researcher forcequit on GitHub, affects devices running iOS 26 and iOS 27. It enables an app to reach every app's data container and, on iOS 27, certain system folders by setting up an App Group container. The researcher described the code as intended for developers and not useful by itself, yet other developers have already built functional applications on top of it.

One such application is WQ Files, a file manager created by developer Christoph Kolbicz. It can read, edit, delete, and clear data from other apps without a jailbreak. The tool installs through sideloading utilities such as AltStore and SideStore, which automatically create the necessary App Group when used with an Apple ID.

Apple's security updates for iOS 26.7.3 and iOS 27.2.1, released yesterday, do not mention or patch the sandbox escape. The company's notes state that it does not disclose issues until a fix is available. Binance confirmed that no attacks or thefts involving worse_query have been reported so far.

The exchange recommends that users delete any apps installed from untrusted sources, keep iOS and all applications updated, and, in case of suspected compromise, transfer funds to a newly created wallet on a clean device while resetting all active sessions.

Binance worse_query forcequit WQ Files AltStore SideStore

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

SAP Patches Four Maximum-Severity Flaws Including ICM2SHELL and PROXYGATE in November 2026 Updates

SAP has released its November 2026 security updates addressing 35 vulnerabilities across multiple products, with four rated at the highest severity level of 10/10 on the CVSS scale. The patches cover memory corruption and missing authentication issues in NetWeaver Application Server ABAP components, as well as broken access control in SAP Gateway and memory corruption in Web Dispatcher. Cybersecurity firm Onapsis, which discovered three of the flaws, tracks CVE-2026-76964 and CVE-2026-89126 collectively as ICM2SHELL and CVE-2026-89103 as PROXYGATE, both enabling unauthenticated remote code execution. These vulnerabilities allow attackers to compromise core SAP systems without credentials or user interaction, potentially exposing business data and transaction integrity. The update follows a series of other critical SAP fixes in recent months, including issues in Commerce Cloud, SAP Kernel, and BTP applications, some of which have seen active exploitation.

BleepingComputerNov 10, 2026Translated from English

Vulns & Exploits

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has released multiple security updates addressing critical flaws in iMessage that could allow unauthorized access to group chat messages. One vulnerability, tracked as CVE-2026-113961, is an authorization issue that permitted remote attackers to join group chats and receive ongoing messages through improved validation fixes. A second issue, CVE-2026-113960, enabled newly added participants to access messages sent before they joined the conversation. The updates also resolve an out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalog on October 27. Additionally, nine separate updates address multiple Bluetooth and AirPlay vulnerabilities that could enable unauthorized pairing or memory corruption without user interaction. The company has not confirmed active exploitation of the iMessage or Bluetooth issues and provided no workarounds for users unable to update immediately.

The Hacker NewsNov 10, 2026Translated from English

Vulns & Exploits

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.

BleepingComputerNov 10, 2026Translated from English