Apple’s Private Cloud Compute breached by root‑level path traversal (CVE‑2026‑20685)
Researchers found a path‑traversal bug in the darwin‑init provisioning service on Apple’s Private Cloud Compute nodes. The flaw lets an attacker write arbitrary files as root during boot, persisting malicious code and hijacking telemetry, undermining the privacy guarantees behind Apple Intelligence. Apple assigned CVE‑2026‑20685.