According to Apple’s release notes, iOS 26.7 includes security fixes, but it does not have any other features.
Apple will eventually show iOS 27 as the main update for the iPhone, but that likely won’t happen for a few weeks. Users who want to stay on iOS 26 for the time being can do so by opting for iOS 26.7 instead of iOS 27 .
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay.
[…]
It must be noted that VPNs are not affected, since they tunnel the device’s entire network traffic at the system level.
[…]
We’ve addressed all three leaks in Psylo 1.3.1[…] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.
In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.
We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing.
[…]
Should we knowingly leave our users exposed while waiting for a system-level fix? We didn’t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn’t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.
Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026 🤯🤯🤯
Apple’s iCloud Private Relay is designed to hide users’ IP addresses from websites and even from Apple itself while browsing in Safari. But according to security researchers Talal Haj Bakry and Tommy Mysk, the feature does not always work as intended because of issues in Apple’s WebKit browser engine.
The problem centers on passkeys, the password-free authentication method that is becoming more widely used. When a user authenticates with a passkey, the request is handled outside the browser itself. Private Relay only protects traffic within Safari (as an iCloud+ feature) and does not function like a full-device VPN. As a result, the authentication request can expose the user’s real IP address to the website or service.
Because the vulnerability sits in WebKit, the engine that powers every browser on iOS, the IP leak is not limited to Safari. Privacy-focused browsers such as OnionBrowser and the researchers’ own Psylo browser can also reveal a user’s IP when passkeys are used.
Re: Responsible Disclosure
We found ourselves in a bit of a dilemma with these DNS and IP leaks in WebKit and how to handle them responsibly.
We first became aware of a DNS leak in Psylo in late June 2026 after a user reported it. During our investigation, we found two… https://t.co/5kFu0jtUsJ
The researchers have already notified OnionBrowser and the Tor Project of their findings and suggested fixes. Apple has told 404 Media that it is investigating the report. However, Bakry and Mysk noted that Apple’s response times for similar privacy issues can be lengthy; a previously reported problem with the Hide My Email feature that allowed real email addresses to leak behind aliases was not fully fixed for about a year after it was disclosed.
MacDailyNews Take: Until a fix arrives, users who rely on Private Relay for anonymity should be aware that logging in with passkeys on iOS may still reveal their IP address.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Três brechas na configuração de proxy do WebKit, que também afetam a Retransmissão Privada (Private Relay) do iCloud+, foram descobertas, permitindo que o endereço IP de usuários da Apple seja exposto a terceiros. O comportamento afeta todos os navegadores para iOS que dependem de conexões proxy para ocultar o IP do iPhone.
A falha foi localizada pelos desenvolvedores Talal Haj Bakry e Tommy Mysk, fundadores do navegador com foco em privacidade Psylo. Eles explicaram como a exposição da informação do usuário ocorre em uma postagem no blog oficial de Mysk:
Navegadores baseados em WebKit no iOS e no macOS podem ser configurados para encaminhar todo o tráfego web por servidores proxy. […] Em teoria, toda conexão de rede iniciada por uma página deveria passar pelo proxy configurado, de modo que os sites enxergassem apenas o endereço IP do proxy. No entanto, descobrimos que três recursos do WebKit ignoram essa configuração e enviam tráfego diretamente do dispositivo.
As três ferramentas mencionadas ao longo do boletim incluem a pré-busca (prefetching) de DNS, que resolve o endereço pelo caminho normal de DNS do dispositivo em vez de pelo proxy, expondo os servidores DNS reais do usuário; o Related Origin Requests (ROR) do WebAuthn, que faz com que o serviço de credenciais do sistema busque, diretamente do dispositivo, um arquivo de validação hospedado no domínio de origem, expondo o endereço real do usuário; e o WebTransport, que ignora o proxy ao estabelecer uma conexão HTTP/3 direta.
No caso do Safari, o recurso Retransmissão Privada do iCloud+ também é afetado pela falha; embora projetado para ter dois servidores intermediários para o tráfego e as consultas de DNS, os recursos listados ocorrem fora desse mecanismo de proteção, expondo o usuário de qualquer maneira.
Isso afeta também navegadores que utilizam a API 1Application programming interface, ou interface de programação de aplicações. de proxy para privacidade, como o Onion, que foi alertado sobre o problema junto do Tor Project. O relatório pontua, no entanto, que a única exceção quanto à exposição desses dados com algum desses recursos é o nível de segurança “Silver” do Onion Browser, que desativa o WebTransport por meio do Modo de Isolamento (Lockdown Mode).
As conexões por VPN 2Virtual private network, ou rede privada virtual. não são afetadas pela falha de segurança, visto que o tráfego do dispositivo passa pelo túnel do provedor da rede privada virtual.
O relatório conclui informando que o problema foi resolvido na versão mais recente do Psylo, que desabilitou por ora o funcionamento do WebTransport e do WebAuthn, além de bloquear a dica de pré-busca de DNS.
Login
