macOS 27.2 fixed 263 CVE, credited 262. Who was uncredited? Me, I think.

Yesterday Apple released a number of software updates, along with lists of security issues fixed in those updates; macOS Golden Gate 27.2 fixed a staggering 263 CVE! (I’ll use “CVE,” Common Vulnerabilities and Exposures, as both singular and plural.) Apple credited 262 of those 263 CVE to at least one person, though in 33 instances an unnamed person was credited, “an anonymous researcher.” There’s one outlier, not credited to anybody, not even an anonymous body: Mail Available for: macOS Golden Gate Impact: The user's original email address may be leaked when using the Hide My Email feature Description: A logic issue was addressed with improved restrictions. CVE-2026-112500 The record posted on cve.org is equally mysterious. This issue caught my eye because it sounds like the one I blogged about back in July: Apple account email address disclosure via Mail app. My blog post was picked up and publicized by some popular news media sites, so somebody at Apple undoubtedly saw it. I don’t…