CrashReportExtension:

The Crash Report Extension framework allows you to perform analysis and produce a report when your app crashes. Your crash-handling code executes out-of-process, rather than from a signal handler or other in-process techniques.

You implement your handler by writing an app extension that conforms to the CrashReporterExtension protocol. The system calls your processCrashReport(process:) method when the app crashes. Use the CrashedProcess parameter to inspect the state of the crashed app by retrieving a crash reason, symbolicating relevant addresses, and communicating with the process over a read-only Mach port. After collecting the crash data, you can send a report back to your own server.

[…]

Crash Report Extension is available on iOS 27 and later. It isn’t available to Catalyst-based macOS apps, or on iOS apps running on Mac computers with Apple silicon.

The top of the page says “macOS 27.0+,” so I guess this means it does work for regular AppKit and SwiftUI Mac apps. It’s great to finally have a supported way to do this.

I don’t know why they can’t just give you the crash report text or .ips JSON directly, though. It looks like you have to use Mach IPC with the corpsePort to get the backtrace for each thread and then use the extension API to symbolicate the addresses. Even then, I’m not sure you can get all the information that’s in a standard crash report, such as the Application Specific Backtrace. Maybe you can find the address for gCRAnnotations/__crashreporter_info__ and load it with mach_vm_read?

Previously:

• WWDC 2026 Links
• Visual Studio App Center Retirement
• What Happened to __crashreporter_info__?
• Restarting macOS Apps Automatically on Crash
• Crash Reporting for Sandboxed Mac Apps
• Reliable Crash Reporting

Researchers have analyzed a high-severity vulnerability in Linux that’s able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel.

The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It’s used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables.

!!!WTF!!!

The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven’t been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root.

Read full article

Comments