[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-sanctioned-russian-firm-finds-11-bugs-in-apple-and-android":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},8443,"sanctioned-russian-firm-finds-11-bugs-in-apple-and-android","Sanctioned Russian Firm Finds 11 Bugs in Apple and Android","A sanctioned Russian security firm reported nine Apple flaws and two Android bugs, including one triggered by simply tapping a malicious NFC tag.","A sanctioned Russian cybersecurity firm just found 11 bugs in Apple and Google software, one of which hijacks a phone with nothing but a tap on a malicious NFC tag.\n\nPositive Technologies, blacklisted under US sanctions, handed its findings to Russian state news agency TASS rather than publishing them directly. Two bugs hit Android, including Pixel phones. One let a rigged NFC tag silently fetch and launch an app with zero owner approval; the other let an app already on the phone switch Wi-Fi networks, install a certificate, or change proxy settings without asking permission. Google closed both holes in its September 2026 patch. The remaining nine flaws hit Apple's software, among them a macOS bug that handed a hostile app full system control, a kernel bug that could crash a device or corrupt its memory, and a flaw that let stored access keys be wiped without the user's consent.\n\nThe NFC bug is the one worth remembering. No click, no prompt, just proximity to a tag someone else planted. That is a far lower bar than the phishing links and malicious downloads most phone attacks still rely on, and it is a reminder that tap-to-pay and tap-to-pair features are also new places to poke. Apple has not said which OS versions its fixes cover, so anyone on an older, unsupported device stays exposed regardless.\n\nNeither Apple nor Google has acknowledged Positive Technologies by name, but both quietly shipped patches anyway, which, sanctions status aside, is about as close to a thank-you note as this story gets.","[\"security\",\"apple\",\"android\",\"vulnerabilities\"]","2026-09-29T21:15:00.000Z","2026-09-29T21:40:25.976Z","2026-09-29T21:40:31.857Z","published",null,[],"security",[24,26,27,28],"apple","android","vulnerabilities",[30],{"name":31,"url":32},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsanctioned-billion-dollar-cybersecurity-company-from-russia-found-11-vulnerabilities-in-google-and-apple-products-including-a-nasty-one-that-compromised-a-device-just-through-a-malicious-nfc-tag",0,{"sections":35},[36,41,44,49,54,59,64,69,74,79,84,89,94,99],{"name":37,"slug":38,"count":39,"latest_published_at":40},"AI","ai",4946,"2026-09-30T00:19:13.000Z",{"name":42,"slug":24,"count":43,"latest_published_at":18},"Security",778,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",416,"2026-09-29T20:53:53.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",284,"2026-09-29T21:00:00.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",194,"2026-09-29T13:16:04.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Science","science",154,"2026-09-28T13:19:18.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Consumer Tech","consumer-tech",142,"2026-09-29T18:38:03.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Software","software",91,"2026-09-25T20:55:00.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Dev Tools","dev-tools",89,"2026-09-29T17:15:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Startups","startups",83,"2026-09-29T21:51:36.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"General","general",49,"2026-09-28T16:44:57.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]