macOS Golden Gate quietly un-fixes the XPdb flock bug: an inverted file-read-data rule in the platform sandbox profile makes XProtect’s behavioral events database readable again, resurrecting the denial-of-service attack against XProtectBridgeService.

How to run Swift toolchains on the current stable Debian release, by working around LLDB’s Python dependency mismatch.

Compute and match file cryptographic or fuzzy hash digests, for threat hunting and binary triage on macOS.

We discuss a bug in XProtect behavior events abused in the wild in the current XCSSET malware campaign, then we explain why XProtect behavioral telemetry is fundamentally flawed.