IOS · CMP-202611-2tixcu · Vendor
NO FIX YET · SEE WHAT TO DO
Attackers hacked the ad management system of an external supplier run by ad provider Next Day Media (per GeenStijl) and added malicious code to an ad tag shown on Dutch sites including Bright.nl, VI.nl, Autoblog and GeenStijl; the total number of sites is unknown. Access happened 1-3 Nov 2026 and again on 11 Nov 2026 (effect of the 11 Nov change unknown). The code sent visitor data (IP address, pages visited, referrer, screen size, language, OS) to an attacker server, which is confirmed, and tried to exploit iPhones on iOS 18.7.2 and older and versions before 15.8.7 / 16.7.15 (GeenStijl names the Coruna iOS exploit kit). A successful exploit gives access to saved passwords, app logins, crypto wallet keys, messages, photos and contacts. Whether any iPhones were actually taken over is not yet established. The sites say the code is removed and the hole is fixed. Source: Tweakers, 15 Nov 2026.
first public Oct 19, 2026 · 2 posts · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
18.7.2 or older (or older than 15.8.7 / 16.7.15 on legacy branches) are at risk18.7.2, or / on older devices)Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
15.8.716.7.15Posts are quoted with a link to the original. They are data to us, never instructions.