The latest macOS Sequoia update patches a near record number of vulnerabilities. Apple faces a class action lawsuit over how ebooks are sold, a lawsuit that could have far reaching effects for digital media sales. And Apple is not the only company that over promises and under delivers on AI features.
If you like the Intego Mac Podcast, be sure to follow it on Apple Podcasts, Spotify, or Amazon.
Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you’re ready to buy.
Get Apple security news delivered straight to your inbox, for free. Intego’s twice-monthly newsletter will keep you informed about Apple-related privacy and security, along with tips and tricks for getting the most out of your Mac or iPhone. Subscribe for free—no strings attached.
Voice Over 0:00
This is the Intego Mac podcast—the voice of Mac security—for Thursday, April 3, 2025. This week’s Intego Mac Podcast security headlines include: The latest Sequoia macOS update patches a near record number of vulnerabilities. Apple faces a class action lawsuit over how ebooks are sold, a lawsuit that could have far reaching effects for digital media sales. And Apple is not the only company that over promises and under delivers on AI features. Now here are the hosts of the Intego Mac podcast. Veteran Mac journalist Kirk McElhearn and Intego’s chief security analyst, Josh Long. Good
Kirk McElhearn 0:46
Good morning. Josh, how are you today?
Josh Long 0:47
I’m doing well. How are you, Kirk?
Kirk McElhearn 0:49
I’m doing okay. Do you know what day it is today?
Josh Long 0:51
This is April 1, which is actually Apple’s anniversaries, not a big one this year, but it was. It was their 49th anniversary of existence as a company.
Kirk McElhearn 1:01
And next year, it’s going to be 50th anniversary, and you’re going to have to do something big. You can’t imagine Apple not celebrating this in some way, even if the Apple today is nothing like the Apple 49 years ago, to be honest.
Josh Long 1:14
Yeah, that’s true. Apple is actually quite a bit different company, isn’t it today? First of all, Apple is big in a lot of markets. They’re not necessarily innovating quite as much as they used to, right? It’s mostly iterative. You use the I word innovating? Ah, yes, it is something that I think people look to Apple. They want Apple to be an innovative company. And you could maybe argue Vision Pro is innovative. But what else has Apple done for us recently in the innovation department.
Kirk McElhearn 1:45
AirTags? Oh, I guess, really useful. I mean, if you think about it, but it’s true that Apple, see, early, Apple was very innovative, and then they turned into, like, beige boxes. And then when Steve Jobs came back, they were innovative again for many, many years. And people got to expect that, that every year there should be some new or every three years some really amazing new Apple product, and we’re not seeing it anymore, and this is a problem for the company.
Josh Long 2:13
Yeah, well, we’ll see. I mean, I do think that there’s a possibility that Apple could start chasing more of the kind of industry trends, right? Maybe they’ll go more into robotics, right? They’re trying this AI thing, and they’re it’s not going so well for them right now, maybe they’ll try robotics next. You know, they gave up on the Apple car. Who knows what’s next for Apple? But hey, maybe we’ll find out something at WWDC in June.
Kirk McElhearn 2:39
Well, they innovated this week with the latest updates to Apple’s operating systems with correct me, if I’m wrong, 131 CVEs for macOS Sequoia.
Josh Long 2:50
That’s right, 131 CVEs. This might be a record. Actually, I saw somebody saying that this was a record number of CVEs patched in one release all at the same time. So what’s notable, I think, about this, is that it’s Apple kind of needed to release a bunch of patches. Because the last couple of rounds of patches that we got from Apple, they only patched like one or two vulnerabilities. So I feel like this was kind of a catch up release.
Kirk McElhearn 3:20
Well, what might have happened is, since they’ve delayed the new Siri for Apple Intelligence, they might have gotten a bunch of people who are working on Siri to go back and work on security, and they caught up with some old bugs. I know it probably doesn’t work like that, but you know, we’ve seen in the past certain times where Apple which release of macOS was it that was delayed for was it when iOS 7 came out that they had a major redesign and so they delayed a macOS release for a couple months because they had to put a whole bunch of engineers working on the iOS release
Josh Long 3:51
That has happened before. Yeah, I so, I don’t, I don’t know, because they did release Sequoia alongside the 18 versions of iOS, iPadOS.
Kirk McElhearn 4:02
But often we have the same number of CVEs, which are a CVE is a named vulnerability. We often have the same number, or close to same number, between macOS and iOS, whereas here there’s twice as many in Sequoia as there are in iOS 18, right?
Josh Long 4:15
There are 62 vulnerabilities in iOS and iPadOS, 18.4 now some of this may just be Apple playing catch up a little bit. I think what it might be this time is that macOS may have had more vulnerable components. Maybe some of the things that were patched at this time for macOS Sequoia are not components that affect iOS or iPadOS that could explain some of the discrepancy. Now, typically, what you’ll find is that there’s a lot of overlap between vulnerabilities between macOS and iOS and iPadOS, et cetera. There’s a lot of shared code between all of Apple’s operating systems. Right? We’ve mentioned before many times how WebKit, for example. Apple is deeply embedded in every operating system. This is the page rendering technology that we would kind of assume has to do with Safari web page rendering, right? But Apple actually uses it for a lot of other things as well. And so when a web kit vulnerability gets patched, usually it has to get patched for all of Apple’s operating systems. So that’s just one example of a component that exists across the board, but there are technologies that are specific to certain operating systems too. macOS, of course, has has a lot of those, being the only desktop operating system that Apple has.
Kirk McElhearn 5:35
Okay, I want to tell you something that just happened while you were talking. My cat, Titus, comes to visit me often when we’re recording a podcast, he’s standing on my desk. I was scratching his head with my left hand, and my watch beeped, and it said, it looks like you’ve taken a fall. So just by scratching my cat, the fall detection was set off. Now I updated to watchOS 11.4 yesterday. Maybe there’s something in the algorithm for the fall detection, but I have had this happen when I’ve been preparing food in the kitchen and I wear my watch on my non dominant hand. So when I’m chopping food, it’s with my right hand, so it’s not hard. And I’ve had this happen a few times in the kitchen with my non dominant hand. So if you see this happen, don’t tap the thing that says, make emergency call. Dismiss it right away. Otherwise it’s going to call an ambulance and send, you know, a chopper to your house or something like that.
Josh Long 6:23
Wow, that’s weird. I haven’t heard of that happening too much. Are you familiar with anyone else having issues with fall detection going off?
Kirk McElhearn 6:31
Yeah, I’ve seen, I’ve seen people on wine talk about this as well.
Josh Long 6:36
Yeah. So this, so this is not necessarily new to the latest watchOS update, which, by the way, came out a day later than all the other updates, right?
Kirk McElhearn 6:43
No, this has only happened for me with watchOS 11, the current version of watchOS in previous versions, this didn’t happen to me, so presumably the algorithm is being changed. If you remember when this first came out, people were getting this a word when they were on roller coasters and things like that, and Apple had to tweet the algorithm. But maybe they’ve gone a little bit, I mean, scratching a cat. It’s not that physical. It shouldn’t do anything like that. Anyway, if I’m not mistaken, they also issued some updates to some really old operating systems, didn’t they?
Josh Long 7:13
Yeah, something that is really, really unusual for Apple is to go back and patch multiple, like, several older versions of an operating system. Usually we talk about on the macOS side, Apple will patch the current and two previous so you could call them n minus one and n minus two right operating systems on the Mac on iOS. Lately, you know, they’ve sometimes been patching the two previous operating systems as well. Under certain circumstances. Right now for the 17 versions, they’re not patching iOS anymore. They’re only patching iPadOS, because all iOS devices, meaning iPhones, can upgrade from 17 to 18. And so Apple has said, Okay, we don’t need to patch iOS 17 for iPhones anymore. They are still releasing iPadOS 17 patches for three specific iPad models that came out in 2017 or 2018 that can’t upgrade to iPadOS 18. But Apple went back further than that. They actually released very small patches for iOS and iPadOS 16 and even 15. So this goes back all the way to iPhone 6s and iPhone seven and the iPad Air two and mini fourth generation, and even the iPod Touch seventh generation. So the iPod Touch hasn’t gotten any security updates for a very long time, and so it was interesting to see Apple going back and patching these operating systems now something that I want to be very clear about, and unfortunately, this is not something that’s clear to users. You might still have a very old device that’s running iOS 15 or even iOS 16, and you might think, Oh, cool. I got security updates this week. However, it’s really important to note there were literally two vulnerabilities that were patched, not the dozens or even a well over 100 vulnerabilities like we saw in all of the current Apple operating systems. This was literally two and these were things that had been previously patched for newer versions and the current version of the operating systems. So these were in the wild, exploited vulnerabilities that Apple felt okay. Well, I guess we should back port those patches to the old, old, old operating systems as well.
Kirk McElhearn 9:44
So this is me going through a pile of papers on my desk and digging down to things a few months ago that I hadn’t seen and saying, oh, I need to take care of this. This is what it sounds like.
Josh Long 9:53
Yeah, it’s it’s interesting, because Apple has done something similar to this before, where typically the. The Old, old operating systems, like when they when they patch something really old, they’re usually only patching the things that have been exploited in the wild. But it always, it seems like, for the most part, there’s a delay. They’ll patch it for the new operating systems first, and then maybe they’ll go back and patch those things for the old operating operating systems too. The thing that always bothers me about when Apple does this is it gives people a false sense of security, right? Because if I’m on an older device, I have no idea how many vulnerabilities are patched, because Apple doesn’t put that right in your face. On your device, you have to go hunting for that information. You have to know where to look for that online and go and choose to look it up yourself or listen to this podcast. Yes, right? Well, if you’re not listening to this podcast, which is 99% of the world, then you have no idea that Apple literally only patched two vulnerabilities for these really old operating systems. And so you might just think, oh, cool, I’m still getting updates. I’m still getting security updates from Apple. And so I’ve always felt that that’s a really big problem, is they’re giving people this false sense of security, because in the meantime, you’ve got hundreds of other vulnerabilities that have not been patched for iOS 15, and so all of these devices are highly vulnerable at this point. All of those vulnerabilities have been out for a very long time, and it’s quite likely that somebody somewhere is exploiting those vulnerabilities. It’s just that Apple hasn’t been made aware of these vulnerabilities being exploited in the wild, and so therefore they’ve chosen not to patch those for the older operating systems.
Kirk McElhearn 11:37
Okay, there seems to be a bug in iOS 18.4 and this has only been out for two days, right? IOS 18.4 a number of people were reporting that apps they previously deleted on their iPhone are reappearing after the update. And what I’m thinking is that so if you tap and hold a home screen, you go into jiggle mode, and then you tap on the little X on an app, you get a dialog asking if you want to delete the app or remove it from the home screen. So if you remove it from the home screen, the icon is gone, but it’s still on your phone in the app library. And I’m thinking that this is what’s happening. People didn’t delete apps, they removed them from the home screen accidentally, and they’re showing up after the update.
Josh Long 12:17
I think that’s probably the most likely answer to what’s going on here. Now, you might remember that there was kind of a similar thing several months ago about potentially sensitive photos being resurrected on your device. Now this, at least, doesn’t have that level of like, Oh my gosh. Like, what’s going on here? If you do have some apps you thought you deleted that are now showing up on your home screen. It’s not the end of the world. You can always remove them again or delete them off of your device, but kind of a weird bug.
Kirk McElhearn 12:47
Okay, so Apple released something new for its most innovative product that it has released ever. It’s the Vision Pro, and it now has Apple Intelligence. Is this exciting or what?
Josh Long 12:58
Well, maybe if you’re using an Apple Vision Pro, for the three or four people out there who have an Apple Vision Pro,
Kirk McElhearn 13:06
and you get Apple Intelligence six months after it came to the iPhone, the iPad and the Mac, to be fair, only some features came out six months ago, and others after that, and others after that, and others like Siri still haven’t come out.
Josh Long 13:18
Yeah, it’s kind of an interesting thing, isn’t it? Right? I don’t know. I always thought it was sort of puzzling that the Vision Pro having an m2 chip and Apple Intelligence requiring just an m1 as a baseline on every other device. I always thought that was kind of weird that Vision Pro didn’t get it right off the bat. I assume it must have been a battery life thing or something, but at least they finally decided to bring Apple Intelligence, as it currently exists, to Vision Pro. So if you happen to have Apple Vision Pro, now you get the Apple Intelligence features finally.
Kirk McElhearn 13:53
Okay, let’s take a break. When we come back, we’ll have some more news.
Voice Over 13:58
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Download the free trial of Mac Premium Bundle X9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the special discount link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.
Kirk McElhearn 15:09
So Apple is no stranger to class action lawsuits, and the latest one, which just dropped before we started recording, I think this is one of the most important class action lawsuits about digital content ever to go forward, whether it actually gets through the courts or not. Basically, it is a lawsuit over the availability of ebooks that Apple sells through the Apple bookstore and you can get in the Apple books app. And the lawsuit is claiming that Apple tells people that they are buying books when they are actually just purchasing a license to use these books and they don’t own them. Now the reason I think this is so important is because pretty much all the digital content that you air quotes buy is not purchased. It’s licensed. This morning I bought a Kindle book. I clicked the button buy. Now I wasn’t buying it. I know I wasn’t buying it. That 99 pence I spent on this book just give me the right to read it until whatever happens, it’s not like the book belongs to me if you buy digital music from most online dealers. Now there’s no digital rights management or DRM on it, so technically you do have more rights, but a company can always turn off your access to this content that you buy, whether it’s movies, TV series, books, music, etc. I find it interesting that the class action suit is only about books. The law firm bringing this suit has a history of class action suits about a variety of things. And what I find funny is that one of the two lead partners in the law firm is named Siri.
Josh Long 16:41
The important distinction here is that when you purchase something, you have an expectation that you get permanent access to it, right? That no matter what, hey, I’ve got a file, a copy of this file backed up, and I can put it on some hard drive and keep it in cold storage if I want to, and I can always access it at any time that I want. And the difference here is that when you’re clicking the buy button, it’s not something that you permanently have access to. You can’t just stick it on an old hard drive and put it in cold storage and access it whenever you want. It’s something that it may temporarily live on your device, but Apple can always revoke the rights to it. So if a publisher says, we don’t want anyone to have access to this copy of this book anymore, then they can remove that book, that ebook, from all of your devices.
Kirk McElhearn 17:35
It’s not just that. If you ever lose access to your Apple account, you’ve lost all that content that you have allegedly purchased. The thing that bothers me the most about books is the lack of interoperability, and Steve Jobs literally forced the music industry to remove DRM from downloadable music under the guise of interoperability that can download music from any store and put it on any MP three player. I like reading on Kindles because I can read outside in the sun, I can’t do this with an iPad, so I just don’t buy books from Apple. I want the ability to buy Kindle books and put them on a different device. I can use a Kindle app on an iPad, but I can’t put them on a Kobo device, for example. And I think all this content should be interoperable, which means it has no DRM, and they should stop pretending that we’re buying it when we’re not. Wasn’t there a story a few years ago where they had to change the buy button to get on the app store for apps that were free or they had in app purchases because you weren’t actually buying anything. I mean, this terminology is kind of important anyway. Class Action shoes like this take a long time. Will they get to court? Will it be accepted? Etc. If it is accepted, I think this is a huge lawsuit, and I’m kind of surprised the European Union hasn’t acted on this. You know, they were heavily involved with music DRM in the past, and then they just gave up about books. We have some browser update stories. It’s Thursday. What do we do on Thursday?
Josh Long 18:58
Restart your browser. I would argue you should probably be doing this every day anyway, just because, if there’s no particular reason why you need to keep your browser open from one day to the next, remember, just about every browser will allow you to reopen the tabs and windows that you had open the last time when you the next time you open them. Right? So might as well quit your browser at the end of every day, and then the next time you relaunch it, if there is an update, it will probably be installed automatically for you. So last week, there was a vulnerability that Google patched for its Chrome browser on Tuesday, and then so all of the other chromium based browsers released patches on Wednesday or Thursday, and then one of them didn’t for macOS, and that was specifically the arc browser. I noticed yesterday, as of they still have not released a patch for this particular vulnerability for the Mac version of the arc browser. So arc is one of these relatively recent browsers from a startup company called the browser. Company, so it’s kind of gained a little bit of popularity, trying to make a name for itself, being a little bit different, having a slightly different interface from some of the other chromium based browsers. They’ve chosen not to patch this particular vulnerability on the Mac. Now, there might be different reasons for that. Interestingly, Google said in its original patch notes that this vulnerability, which has been exploited in the wild and been used to spread malware, it’s only known to have spread malware on Windows systems, and so that might be the reason why arc didn’t feel it was necessary to update to the latest version of Chromium for their Mac version. But then again, everybody else did. All the other browsers by now have put everybody on the latest version of Chromium. So it’s a little bit puzzling. Meanwhile, by the way, Firefox, if you happen to be a Firefox user, they also released a similar patch. They noticed that, hey, we use some of similar technologies in Firefox to what was patched in Chromium, and so they found a similar vulnerability and patched it. This is only available on Windows, by the way, so if you do have the Mac version of Firefox, interestingly, you don’t get this patch because they say it only affects the Windows version.
Kirk McElhearn 21:19
Okay, in recent months, we’ve been talking about these phishing attacks that come over iMessage, not just text messages, but iMessage. And there’s an interesting article we’re going to link to, bleeping computer talking about the phishing as a service platform named Lucid that has been targeted 169 entities in 88 countries with well crafted messages sent on iMessage and RCS Android. Basically, these are device farms. And there’s a photo in the article that shows all these iPhones connected to wires, and a lot of them have screens showing the Shortcuts app. So they’ve obviously configured a bunch of Shortcuts to send these things out. And I guess if someone replies, then someone goes to the phone and goes further and enters different information. These are the kind of messages that you get that tell you, at least tell you on an iPhone that you have to please reply. Why then exit the text message and open it again to activate the link or copy the link into your Safari browser and open it. I mean, I can understand a lot of people who don’t really know how these things work and might fall for this, but if you ever see this, this is bogus. This is a scam. They’re trying to get you to go to this link in your browser download software that will allow them to compromise your device.
Josh Long 22:35
Remember all of those scam text messages we’ve been talking about recently? This, apparently, is the campaign that has been sending out all of these I messages and and RCS and text message, SMS, text messages that claim that you need to pay a toll or whatever that are using, dot top, dot, CFD and some of these other weird domain names. All of these are probably coming from a camp, either this particular campaign or one very similar to it, because the the exact text message in some of these screenshots that you’ll see in this article are pretty much exactly the same things that we’ve been talking about and writing articles about in recent weeks, so so that there’s still the question of and Apple never responded to me, not surprisingly, of why exactly, Apple is not blocking these things if they’re being sent over iMessage like it’s what’s one thing if they’re sent over SMS, right? And in fact, in that case, the carrier should be intercepting these messages. And my assumption is maybe one of the reasons why they’re using iMessage is because there’s only one layer now, it’s just Apple that they’ve got to get past. And if Apple’s not really doing very much to block these 1000s upon 1000s of messages that are all saying basically exactly the same thing and are all very obviously spam, then, well, if Apple’s not gonna do anything to stop them, they might as well just continue to send spam over iMessage.
Kirk McElhearn 24:13
What’s the point of Apple Intelligence, if it lets this sort of thing get through? I’m really curious if anyone is listening and you get an Apple Intelligence notification summary for this type of spam. Drop us a line at podcast@intego.com I’m really curious how Apple Intelligence summarizes this, whether it makes it look real or whether it makes it look like a scam. A couple weeks ago, someone forwarded me a message they got claiming to be wrote from Royal Mail. So Royal Mail is the postal delivery service here in the UK, and it said Your Royal Mail parcel cannot be delivered due to missing or damaged address information. It just so happened that the person had sent a package via Royal Mail the day before, but knowing all the things that I explained about computer security, this person said, Wait a second. Is this real? This article. Points out the types of companies that are mostly targeted are delivery companies, like the US Postal Service, DHL, Royal Mail, FedEx, as you mentioned, toll. So easy pass sun, pass, different banks, different credit card companies, even Transport for London, which is the organization that oversees the tube or the underground and the double decker busses in London, plus a lot more. So if you see one of these things, it’s fake. And seriously, I’d like to see what Apple Intelligence does for the notification. Okay, we talked Two episodes ago about Apple delaying the new Siri, that instead of it coming when the iPhone 16 was ready for Apple Intelligence, we’re likely to not see it until the fall, if not later. Well, it turns out that Alexa plus is also launching without their really advanced features. You may have heard of Alexa plus. Amazon announced this March, I think, a month ago, and it was going to be a new, better Alexa, and then all of a sudden they realize they can’t do it. So is it vaporware like Siri? If you have an Alexa device and you were expecting this, you won’t be getting it right away. We looked on the Amazon website, and they’re not really advertising this as a service with Alexa with echo devices, unlike Apple, which has been pushing Apple Intelligence as a main feature for their new devices. So if you’re expecting Alexa, plus, you’ll be waiting for a while.
Josh Long 26:23
At least, for some of those features that they advertised and showed in in their their video, their presentation video, which, which is very similar, that, that part of it is very similar to Apple, right? They may not be saying anything about Alexa. Plus, when you’re going to buy one of these echo devices right now, but nevertheless, like when you have a big keynote presentation with a pre recorded video that’s showing all of these features that you’re supposed to be able to get, and then you might buy a device based on that. And it turns out, well, you may get that feature eventually, if we can ever figure out how to do it like this is not the direction that any company should be going. And it’s really, first of all, it’s really sad that Apple did this right, because now Apple has eroded its users trust in anything that Apple announces is coming soon. Now we have to have a healthy dose of skepticism about it, and now for other companies to try to copy that. That doesn’t feel good. I don’t think that was a wise move on Amazon’s part.
Kirk McElhearn 27:26
It turns out that this so called AI stuff is really hard, and I think the companies didn’t think it was be as hard as it was, especially Apple Siri, which would be sort of digging into all your apps and looking at what’s on screen. Anyway. We’ll find out about that in June at the worldwide developer conference. Won’t we.
Josh Long 27:43
Well, one would hope i one way or another, Apple’s got to say something about it, by the way. As a fun little aside to this, there’s a startup company that claims to have one of these little devices. I don’t do you remember, friend? I don’t remember if we talked about it on the podcast. It’s this little it looks like an air tag that hangs around your neck. This is supposed to be shipping this July, and it’s a little device that you can that has an artificial intelligence you talk to, and it’s your little friend. Oh, I remember this year, right? And there’s another startup now that says that they’re gonna beat them to market by a month, and it’s gonna cost $10 less, and it includes a whole bunch of these features that Apple, for example, is claiming, or had previously claimed, we would get as part of the new Siri that now they’re saying are going to ship in June in their little device that hangs around your neck. So I’m very curious to see whether they can actually deliver on that promise, because that’s a really short window. That’s only two months, two to three months from now.
Kirk McElhearn 28:42
Okay, that’s enough for this week until next week. Josh, stay secure.
Josh Long 28:45
All right, stay secure.
Voice Over 28:49
Thanks for listening to the Intego Mac podcast. The voice of Mac security with your hosts, Kirk McElhearn and Josh Long. To get every weekly episode be sure to follow us in Apple podcasts or subscribe in your favorite podcast app, and if you can leave a rating, a like or a review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com. The Intego website is also where to find details on the full line of Intego security and utility software. intego.com.
