Pegasus zero-click iPhone hack built a functioning software CPU inside the image parser
TheMoonMidas · x · 2026-11-06
- Attackers sent an iMessage with a fake GIF targeting Apple's image decompression engine—no tap required.
- The decompression math was flexible enough to chain arithmetic ops into logic gates (AND/OR/XOR/XNOR), defining over 70,000 segment commands.
- The result: a small computer architecture with registers, a full 64-bit adder, and a comparator, executing raw code before the phone even buzzed with a notification.
More from Safety
- California AG hiring attorneys to enforce AI laws including SB 53 — AaronBergman18 · 2026-11-06
- Provider-level verifiable tool call results are essential for LLM agents — Sauers_ · 2026-11-06
- One-letter URL encoding bypass exposed Hugging Face chat admin API, bulk export of private chats — cyb3rops · 2026-11-06
- Microsoft and FIRST define RCE differently — the Paint advisory saga continues — cyb3rops · 2026-11-06
- Microsoft's Paint "RCE" advisory baffles researchers: network-triggered with no user interaction? — cyb3rops · 2026-11-06
- AI fraud kingpin behind OnlyFake tells all: fake IDs, the FBI, and North Korea — Bedrovelsen · 2026-11-06