Key takeaways
- A public exploit called worse_query lets an app on your iPhone read other apps’ files on iOS 26 and iOS 27, with no jailbreak.
- Binance warned its users on November 10. Apple has said nothing, and the researcher says iOS 27.2.1 doesn’t fix it.
- My view: Apple sells privacy as a human right, then lets a crypto exchange tell us about a hole in iOS. Security is the excuse when Apple is slow, and silence when Apple is the problem.
A sandbox escape called worse_query lets an app installed on an iPhone read the files of other apps on iOS 26 and iOS 27, with no jailbreak needed. The code went public on November 8, crypto exchange Binance warned its users on November 10, and Apple has not said a word, while the researcher says iOS 27.2.1 does not fix it.
In this article: I learned about a hole in iOS from a crypto exchange · Again. That’s the scariest word here · Security is the excuse, silence is the answer · Yes, Apple will blame sideloading · The timeline Apple doesn’t talk about · My guess: a quiet fix and one boring line · What you should do today · FAQ
I learned about a hole in iOS from a crypto exchange
Let me say it clearly: this is not normal. Apple is the company that puts “Privacy is a fundamental human right” on billboards. And when a door in iOS stands open, the warning doesn’t come from Cupertino. It comes from Binance, on X, because Binance is worried about its own users’ money.
Think of an apartment building. A tenant on the third floor finds out the master key opens every flat, so he tapes a note in the elevator: “lock up your valuables.” The landlord? Silent. That’s where we are today.
Binance said it plainly: it’s “an iOS-level issue, not unique to Binance.” So every app that keeps something on your phone lives in the same building. Your wallet app, your banking session, your login tokens.
Again. That’s the scariest word here
The researcher, who goes by forcequitOS, announced worse_query as a zero-day sandbox escape for iOS 26 and 27, “again.” In August he published bad_query, the same kind of hole. Three months later it’s back with a new name.
And one detail I can’t stop thinking about: he says he won’t even ask Apple for a bug bounty, because Apple responded too slowly. When the people who find your holes stop wanting your money, the problem isn’t them. In my view, that says more about Apple’s security today than any keynote.
Security is the excuse, silence is the answer
Nine days ago, John Ternus told analysts that Siri agents must wait, because security and privacy come first. I called it an excuse back then. Then Apple decided to hide AI agents from the Full Disk Access list on the Mac, for our safety. Fine.
But a public tool that lets one app read the data of every other app on your iPhone? Nothing. No statement, no “we’re investigating,” not one line in the iOS 27.2.1 notes released on Monday. Security is loud when it helps Apple explain why it’s late. It goes quiet when Apple is the one with the hole.
And now picture the agent Siri Apple wants next year, with access to your email, contacts and money, sitting on top of a sandbox that leaks. Who protects us then?
Yes, Apple will blame sideloading
I know exactly what Apple’s defenders will say: the main risk is apps installed outside the App Store, through tools like AltStore or SideStore, so stay in the App Store and you’re fine. Partly true. Today that is the easiest way in.
But the hole is in iOS, not in AltStore. And I defended the App Store for years, until hundreds of hidden deepfake apps got through Apple’s review. Nobody has shown an App Store app using worse_query, and I hope nobody will. But after that, “App Review will catch it” is no longer a promise for me.
The timeline Apple doesn’t talk about
| When | What happened |
|---|---|
| August 2026 | bad_query, an earlier sandbox escape, goes public |
| November 8 | worse_query code goes public for iOS 26 and 27 |
| November 9 | Apple ships iOS 27.2.1, the security notes don’t mention it |
| November 10 | Binance warns its users on X |
| November 11 | Apple: no comment |
My guess: a quiet fix and one boring line
I think Apple will fix it quietly in the next update, and the note will say something like “a logic issue was addressed with improved validation.” No warning to users, no apology, nothing about how long the door stood open. That’s the Apple way now: patch, stay silent, let friendly media write that everything is fine. It’s the same silence I saw when Apple warned 99 countries about spyware and wouldn’t say who was behind it. I’d love to be wrong.
What you should do today
To be fair, no thefts have been confirmed, and according to one technical analysis, data in the iOS Keychain stays protected. So don’t panic. But:
- Update to iOS 27.2.1 anyway. It fixes other holes, even if not this one.
- Delete apps you don’t know or don’t use, especially anything installed outside the App Store.
- Never keep a seed phrase in a screenshot, a note or a photo. Use paper, or a hardware wallet for bigger money.
- If you think something was taken, create a new wallet on a clean device and move your funds. Deleting an app doesn’t un-copy your keys.
- Ignore messages that “warn” you about this bug and ask for your recovery phrase. That’s the next scam.
Also on Evolt News: Thai Opposition Leaders Got Apple’s Spyware Warning. Now the Government Wants to “Check” It · Apple Warned 99 Countries About Spyware. It Still Won’t Say Who’s Behind It · Siri AI Agents Must Wait for “Security”? It’s an Excuse, and Apple’s Own Beta Proves It
Featured image: iPhone 17 Pro. Photo: Olgierd Rudak / Wikimedia Commons (CC0).
This article is opinion.
iOS worse_query sandbox escape: FAQ
What is worse_query?
A public iOS sandbox escape that lets an installed app read files belonging to other apps, without a jailbreak.
Which iOS versions are affected?
Binance lists iOS 26.7.1, 27.0.1 and 27.2. The researcher says iOS 27.2.1 and the iOS 27.3 beta are affected too.
Does iOS 27.2.1 fix it?
Apple’s security notes for iOS 27.2.1 don’t mention it, and the researcher says it isn’t fixed. Apple hasn’t commented.
Can App Store apps use it?
No App Store app has been shown using it. The realistic route today is an app installed outside the App Store, such as through AltStore or SideStore.
Is my crypto wallet at risk?
It depends on how the wallet app stores its data. No thefts have been confirmed. Don’t keep seed phrases in files, notes or screenshots.
What did Apple say?
Nothing publicly so far.
I read this news on AppleInsider.
Sources: Binance (X), forcequitOS (X), AppleInsider, BleepingComputer, Inc., Bitdefender, CyberInsider, Security Affairs.
Our Take
Apple’s privacy marketing works only if Apple speaks first when something breaks. Here, users heard about a hole in iOS from a crypto exchange, while Apple shipped an update without a word about it.
Nobody has lost money yet, and the fix may come quietly next week. But a company that delays its own products “for security” should be the loudest voice when its own security fails, not the quietest.
