Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsYes—two flaws in Apple’s outbound iCloud Mail processing let an authenticated iCloud user make a message appear to come from an arbitrary @icloud.com address. The disclosed issues were reportedly fixed: researcher Timo Longin of SEC Consult confirmed remediation on December 9, 2025. The finding describes sender impersonation, not access to another person’s account or mailbox.
What the iCloud Mail flaws allowed
Email has a visible From: header, which most mail apps emphasize, and a separate SMTP envelope sender, commonly reflected in a message’s Return-Path. Those identities can differ. In the reported flaws, an authenticated iCloud sender could exploit how Apple’s outbound mail components interpreted a crafted message so that sender validation and later processing disagreed about the visible From address.
As an Amazon Associate I earn from qualifying purchases.
SEC Consult’s October 1, 2026 technical disclosure describes two parsing discrepancies. They were separate ways to manipulate Apple’s outbound processing, not evidence that an attacker could sign in as the person shown in the message.
Recommended Free Tools
How the two techniques differed
| Reported technique | Parsing discrepancy | Result described by SEC Consult |
|---|---|---|
| Carriage-return header manipulation | An initial component ignored a malformed From header during account-to-sender validation; a later component stripped or normalized the carriage-return characters and processed a different From header. | The message could pass sender validation while presenting a different visible From identity downstream. |
| Dot-stuffing and dot-peeling inconsistency | After Apple changed the first behavior, a second issue was found in how different parsers handled SMTP dot-stuffing and dot-peeling. | The mismatch again allowed validation and later processing to interpret the message differently, enabling a spoofed visible From address. |
In both cases, the core weakness was inconsistent interpretation between stages of Apple’s outbound SMTP pipeline. SEC Consult’s Longin characterized the work as exploring “a subclass of email spoofing” called “header smuggling,” rather than discovering a novel traditional SMTP-smuggling technique.
#1 Best Overall
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charging cable.
- Tested for battery health and guaranteed to have a minimum battery capacity of 80%.
Why SPF, DKIM, and DMARC could still pass
SEC Consult reported that demonstrated spoofed messages could pass SPF, DKIM, and DMARC. Apple’s legitimate mail infrastructure transmitted the messages, and DKIM signing occurred after the affected parsing stage. The displayed From domain remained icloud.com, allowing authentication alignment checks to pass even though the visible identity did not identify the authenticated sender.
Those results do not mean that every message with passing authentication is unsafe. They show that a pass result, by itself, did not establish that the person named in the visible From field authored this particular message.
Rank #2
- 6.9" LTPO Super Retina XDR OLED, 120Hz, HDR10, Dolby Vision, 1320x2868px at 460ppi, 1000 nits (typ), 2000 nits (HBM), 4685mAh Battery
- 1TB, 8GB RAM, Apple A18 Pro (3nm), Hexa-core (2x4.05 GHz + 4x2.42 GHz), Apple GPU 6-core, iOS 18, upgradable to iOS 18.3
- Rear camera: 48MP, f/1.8 (wide) + 12MP, f/2.8 (periscope telephoto) 5x optical zoom + 48MP, f/2.2 (ultrawide), TOF 3D LiDAR scanner (depth), Front Camera: 12MP, f/1.9 (wide)
- 2G: 850/900/1800/1900, 3G: HSDPA 850/900/1700(AWS)/1900/2100, 4G LTE: 1/2/3/4/5/7/8/12/13/14/17/18/19/20/25/26/28/29/30/32/34/38/39/40/41/42/48/53/66/71, 1/2/3/5/7/8/12/14/20/25/26/28/29/30/38/40/41/48/53/66/70/71/75/76/77/78/79/258/260/261 SA/NSA/Sub6/mmWave - Dual eSIM
- Unlocked for freedom to choose your carrier. Compatible with both GSM & CDMA networks. The phone is unlocked to work with all GSM Carriers & CDMA Carriers Including AT&T, T-Mobile, Verizon, Sprint., Etc.
Disclosure timeline and current status
- May 21, 2024: SEC Consult submitted its report on the carriage-return/From-header issue to Apple.
- November 4, 2024: Apple confirmed that it had remediated the first report.
- November 19, 2024: Apple awarded the report a $15,000 Apple Security Bounty, according to SEC Consult’s timeline.
- December 6, 2024: SEC Consult found the related dot-stuffing parsing issue. Subsequent testing found that interim changes did not fully prevent spoofing.
- May 2025: Apple said an update had shipped; SEC Consult later confirmed that a bypass remained.
- December 9, 2025: SEC Consult confirmed that deployed fixes remediated the reported issues.
- October 1, 2026: SEC Consult published its technical disclosure. SC Media covered it on October 5, 2026.
The remediation status here is based on the researcher’s verification. The incident-specific sources do not establish a confirmed real-world attack count, the number of affected users, or an Apple security advisory identifier.
What this means if you receive a suspicious message
The finding does not show that the flaws let someone log in to the apparent sender’s iCloud account or read a recipient’s mailbox. It concerns abuse of Apple’s sending pipeline to misrepresent the visible identity in email.
Quick Recap
Best Value
- 6.7inch Super Retina XDR display. ProMotion technology. Always-On display. Titanium with textured matte glass back. Action button
- Dynamic Island. A magical way to interact with iPhone. A17 Pro chip with 6-core GPU
- Pro camera system. 48MP Main | Ultra Wide| Telephoto. Super-high-resolution photos (24MP and 48MP). Next-generation portraits with Focus and Depth Control. Up to 10x optical zoom range
- Emergency SOS via satellite. Crash Detection. Roadside Assistance via satellite
- Up to 29 hours video playback. USB-C, Supports USB 3 for up to 20x faster transfers. Face ID
Rank #4
- This pre-owned product is not Apple certified, but has been professionally inspected, tested and cleaned by Amazon-qualified suppliers.
- There will be no visible cosmetic imperfections when held at an arm’s length.
- This product is eligible for a replacement or refund within 90 days of receipt if you are not satisfied.
- Product may come in generic Box.
Rank #3
- 6.1inch Super Retina XDR display. Aluminum with color-infused glass back. Ring/Silent switch
- Dynamic Island. A magical way to interact with iPhone. A16 Bionic chip with 5-core GPU
- Advanced dual-camera system. 48MP Main | Ultra Wide. Super-high-resolution photos (24MP and 48MP). Next-generation portraits with Focus and Depth Control. 4X optical zoom range
- Emergency SOS via satellite. Crash Detection. Roadside Assistance via satellite
- Up to 26 hours video playback. USB C, Supports USB 2. Face ID
- Do not treat a familiar display name or an authentication “pass” result as proof that the named person wrote the message.
- For an unexpected request involving a password, payment, or urgent action, verify it through a separate, already-known channel rather than replying to the message or using contact details it supplies.
- If you are investigating a message, inspect its complete headers and compare the visible
Fromaddress withReturn-Pathand the authentication results. SEC Consult notes that headers could retain clues about the authenticated sending account; a difference is useful context, not proof on its own.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
