+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables (/showthread.php?tid=6326026)
Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables - Hackers - May 25, 2026
https://www.sentinelone.com/vulnerability-database/cve-2026-28914/
Quote:CVE-2026-28914 is a logic flaw in Apple macOS that allows a maliciously crafted ZIP archive to bypass Gatekeeper checks. Gatekeeper enforces code-signing and notarization policies on downloaded content. By exploiting improper file handling during archive processing, an attacker can deliver unsigned or unnotarized payloads that execute without the expected security prompts. Apple fixed the issue in macOS Tahoe 26.5. The vulnerability is tracked under [CWE-358: Improperly Implemented Security Check for Standard].
Seems pretty new & relevant. Wonder how many people aren't on Tahoe 26.5...
Affected Products
Apple macOS versions prior to macOS Tahoe 26.5
Systems relying on Gatekeeper for code-signing and notarization enforcement
Endpoints that process ZIP archives from untrusted sources (email, browsers, messaging)
... Seems like it only really gained traction in reporting DBs as of May this year.
Pretty scary:
Quote:An attacker crafts a ZIP archive whose internal structure causes macOS to omit or mishandle quarantine propagation or signature verification on the extracted contents. The archive is delivered through phishing, drive-by download, or supply-chain distribution. When the user extracts and launches the embedded payload, Gatekeeper does not block or warn, and the code executes as if it were trusted.
RE: Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables - DramaKing - May 25, 2026
I know I'm not.
RE: Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables - CL1B - May 25, 2026
8/10 Power users would go trough security pop up, even for legit apps/tools. As apple enforces this for almost all non App Store apps.
So while this short lived cve that's like bypassing MOTW (4 win devs) did work and is clever, I don't think it's really noteworthy or "scary" in osx. Almost any profession (where you use a osx machine) requires you to use osx by manually bypassing the same security checks otherwise it's useless.
RE: Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables - DramaKing - May 25, 2026
(May 25, 2026 05:41 AM)MarlboroMan Wrote: 8/10 Power users would go trough security pop up, even for legit apps/tools. As apple enforces this for almost all non App Store apps.
So while this short lived cve that's like bypassing MOTW (4 win devs) did work and is clever, I don't think it's really noteworthy or "scary" in osx. Almost any profession (where you use a osx machine) requires you to use osx by manually bypassing the same security checks otherwise it's useless.
A malicious package just has to seem trustworthy. "Oh, it's just not Apple-approved."
RE: Breaking code signing / Gatekeeper on MacOS builds for .ZIP payloads & executables - Hackers - May 26, 2026
(May 25, 2026 05:41 AM)MarlboroMan Wrote: 8/10 Power users would go trough security pop up, even for legit apps/tools. As apple enforces this for almost all non App Store apps.
So while this short lived cve that's like bypassing MOTW (4 win devs) did work and is clever, I don't think it's really noteworthy or "scary" in osx. Almost any profession (where you use a osx machine) requires you to use osx by manually bypassing the same security checks otherwise it's useless.
Yeah, also I re-read and it's only for Tahoe before this incremental update. I thought this affected all past Mac versions. I agree though, the constant warning on all programs definitely is a good reminder for users to be careful. On the flip side though, this does normalize it and i've noticed that when i use my mac, I stop thinking about it as much because an extremely credible company gives me the same warnings as an indie project does. That could be considered a feature, or a bug... On one hand, it treats everything as insecure. On the other, the user becomes complacent and stops treating the warnings as meaningful because they pop up for everything.
I can definitely relate in this way - I am not 100% sold on 'warn for everything' because of the effect it can have