Reading List
The most recent articles from a list of feeds I subscribe to.
Welcome (Back) to Macintosh
Apple Watch Fitness Regressions
How Long Will My Mac’s SSD Last?
Daring Fireball Weekly Sponsorship Openings
Weekly sponsorships have been the top source of revenue for Daring Fireball ever since I started selling them back in 2007. They’ve succeeded, I think, because they make everyone happy. They generate good money. There’s only one sponsor per week and the sponsors are always relevant to at least some sizable portion of the DF audience, so you, the reader, are never annoyed and hopefully often intrigued by them. And, from the sponsors’ perspective, they work. My favorite thing about them is how many sponsors return for subsequent weeks after seeing the results.
Sponsorships have been selling briskly, of late. There are only three weeks open between now and the end of June. But one of those open weeks is next week, starting this coming Monday:
- March 9–15 (Update: Sold)
- April 20–26 (Update: Sold)
- May 25–31
I’m also booking sponsorships for Q3 2026, and roughly half of those weeks are already sold.
If you’ve got a product or service you think would be of interest to DF’s audience of people obsessed with high quality and good design, get in touch — especially if you can act quick for next week’s opening.
Google’s Threat Intelligence Group on Coruna, a Powerful iOS Exploit Kit of Mysterious Origin
Google Threat Intelligence Group, earlier this week:
Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.
The Coruna exploit kit provides another example of how sophisticated capabilities proliferate. Over the course of 2025, GTIG tracked its use in highly targeted operations initially conducted by a customer of a surveillance vendor, then observed its deployment in watering hole attacks targeting Ukrainian users by UNC6353, a suspected Russian espionage group. We then retrieved the complete exploit kit when it was later used in broad-scale campaigns by UNC6691, a financially motivated threat actor operating from China. How this proliferation occurred is unclear, but suggests an active market for “second hand” zero-day exploits. Beyond these identified exploits, multiple threat actors have now acquired advanced exploitation techniques that can be re-used and modified with newly identified vulnerabilities.