The US cyber agency CISA has added a WebKit flaw Apple patched eighteen months ago to its list of vulnerabilities confirmed as exploited, after researchers linked it to a watering-hole campaign aimed at unpatched iPhones.

CVE-2024-27834 is an improper authentication flaw in WebKit that lets an attacker who already has arbitrary read and write access to a device bypass Pointer Authentication, a hardware-backed check designed to stop memory corruption becoming code execution. It carries a CVSS score of 5.5. Apple fixed it on 13 May 2024 in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5, with iOS 16.7.8 for older devices.

CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 4 November 2026 and gave US federal civilian agencies until 18 November to apply the fix. The listing marks known ransomware use as unknown and names no attacker or victim count.

The addition follows research by Sekoia, published the same day, into a campaign it calls Poisoned Source. Sekoia said attackers compromised legitimate websites and the Ukrainian analytics service Plerdy to serve exploit chains silently to visitors from 27 August 2026. One chain aimed at iOS 16.7 combined a WebKit remote code execution flaw, CVE-2025-43529, with CVE-2024-27834 to forge the valid pointers needed for code execution. Sekoia attributes the campaign to APT29, the group tied to Russia's Foreign Intelligence Service, with moderate to high confidence.

Every flaw in the chains had been patched before the campaign began, Sekoia said, so devices running current software are not affected. The risk sits with phones and tablets that never installed the 2024 fixes, the same devices the campaign was built to catch. Users should check for pending updates and install them.