Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Apple Hide My Email privacy flaw fix

Security Patch Release
First reported
Last updated
Happening score
H score 18
1 unique sources, 1 articles

Summary

Hide ▲

Apple deployed a fix for Hide My Email after a flaw could expose users' real email addresses in mail logs when messages were rejected as spam. The issue undermined the privacy protections of the iCloud+ feature by revealing the address behind a disposable forwarding alias. Apple reportedly pushed the patch on July 3, 2026, after the problem had been disclosed in June 2025 and unsuccessfully addressed in March 2026 and June 30, 2026. Addresses tied to Hide My Email aliases created before July 7, 2026 may have been captured in transfer logs before the working fix landed.

Related Happenings

Class action lawsuit Apple is accused of misleading customers about Hide My Email privacy while charging for it on Legal exposure over privacy representations for a paid iCloud+

Regulatory/Legal Action
H score12 First: 21.07.2026 21:46 Last: 21.07.2026 21:46 Sources 1

How related: The development comes as Apple is facing a class action lawsuit, accusing it of misleading customers about the privacy of its Hide My Email feature while charging for it.

About this happening: A class action lawsuit is targeting Apple over Hide My Email privacy claims, creating legal exposure tied to the paid iCloud+ feature. The complaint says Apple mis...

Open Happening

AirDrop and Quick Share fixes from Apple and Google

Security Patch Release
H score27 First: 30.06.2026 12:27 Last: 30.06.2026 12:27 Sources 1

About this happening: Apple and Google have started shipping fixes for the disclosed AirDrop and Quick Share flaws, reducing exposure for nearby attacks against widely used sharing feat...

Open Happening

Apple out-of-band iOS/iPadOS security updates (CVE-2026-28950)

Security Patch Release
H score28 First: 22.04.2026 23:58 Last: 22.04.2026 23:58 Sources 1

About this happening: Apple released out-of-band security updates for iPhone and iPad on April 22, 2026 to fix CVE-2026-28950. The patch addresses a Notification Services flaw t...

Latest development: 23.04.2026 11:50

Apple issued iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 on 2026-04-23 to close CVE-2026-28950, which could preserve deleted-message notifications on affected devices.

Open Happening

Apple account change notification phishing campaign

Campaign
H score30 First: 19.04.2026 19:03 Last: 19.04.2026 19:03 Sources 1

About this happening: A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authen...

Open Happening

Unnamed high-profile Lebanese journalist hit by network compromise

Incident
H score10 First: 09.04.2026 13:45 Last: 09.04.2026 13:45 Sources 1

About this happening: An unnamed high-profile Lebanese journalist had an Apple account successfully compromised in 2025, creating unauthorized access to a personal and professional identity...

Open Happening

Timeline

  1. 21.07.2026 21:46 1 articles · 3h ago

    Apple receives disclosure of Hide My Email unmasking flaw

    Initial Disclosure

    Tyler Murphy of EasyOptOuts disclosed to Apple that a Hide My Email flaw could expose users' real email addresses in mail logs when messages were rejected as spam, undermining the privacy guarantees of the iCloud+ feature.

    Show sources
    Open in new tab
  3. 21.07.2026 21:46 2 articles · 3h ago

    Apple deploys fix for Hide My Email unmasking flaw

    Mitigation Patch Update

    Apple deployed a fix for the Hide My Email issue on July 3, 2026, closing a flaw that could cause a user's real email address to appear in mail logs after spam rejection.

    Show sources
    Open in new tab
  4. 21.07.2026 21:46 1 articles · 3h ago

    Hide My Email flaw can expose real email addresses in mail logs

    Technical Analysis Update

    A Hide My Email flaw could expose a user's real email address in email logs when a targeted message was rejected as spam, and aliases created before July 7, 2026 may have been captured in mail transfer logs.

    Show sources
    Open in new tab