Welcome to 95 Mac Daily for Tuesday, July 29th, 2025.

I'm your host, Chance Miller.

We are sponsored this week by Bitwarden.

Leading off today, Microsoft has detailed a serious macOS vulnerability that could allow malicious apps to bypass system privacy protections.

Microsoft researchers refer to this as exploitlight, and the flaw exploited how Spotlight

indexes plug-in data to access sensitive files and Apple intelligence metadata.

Apple addressed the issue and an update to MacOS in March, but users on older versions

could still be at risk. Microsoft first alerted Apple to the exploit vulnerability upon discovery.

The exploit targeted macOS's spotlight search and its metadata indexing process. Malicious

apps dropped specially crafted plugins in user-writable directories.

Spotlight would then index those plugins and trigger and execution without user interaction.

This allowed access to protected locations like your downloads folder or your Safari data.

Apple Intelligence Cash metadata could also be read under this vulnerability,

and the exploit bypassed Apple's transparency, consent, and control protections due to a design flaw.

This is an example of the security research process at its best.

Microsoft discovered the vulnerability, reported it to Apple,

Apple patched it with macOS15.4 in March. Microsoft waited four months before disclosing the

details of the vulnerability to the public to give Mac users ample time to update to the

vulnerability fix. But if you haven't updated to macOS Sequoia 15.4,

be sure to do that now by going to the system settings app choosing general, then choosing software

update. Next up today, here's a wild story that you should treat with a little bit of skepticism

for the time being. On Monday evening, a user on Twitter posted a pair of images that allegedly show someone

...