🛡️ CVE-2026-20685

The items that name it 2

• Beyond Prompt Injection: Hacking Apple's Private Cloud Compute
  writeup2026-08-10

  Path traversal vulnerability in darwin-init, the code that provisions Apple Private Cloud Compute (PCC) nodes, allowing an attacker to write files as root outside the intended extraction directory. Found by Drinor Selmanaj via Apple's Virtual Research Environment. Apple rated it as information discl

• CVE-2026-20685: An attacker in a privileged network position may be able to leak sensitive information
  advisory

  An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation.