Patrick Wardle (@patrickwardle) / X

Patrick Wardle

10.5K posts

Patrick Wardle

@patrickwardle

🛠 🍎 👾 Objective-See'ing & DoubleYou'ing

Maui, HI

Joined October 2013

Pinned
Patrick Wardle
@patrickwardle
Apr 25, 2024
Stoked for the next (ad)venture: "DoubleYou" techcrunch.com/2024/04/25/ex-… Cofounded w/ long-time friend @hexlogic, we're empowering those building security tools for Apple devices 🍎🛡️ And by bootstrapping this venture, our core value of democratizing security remains our focus!
Ex-NSA hacker and ex-Apple researcher launch startup to protect Apple devices | TechCrunch
From techcrunch.com
Patrick Wardle
@patrickwardle
Aug 5
Stoked to be presenting today at #BlackHat Arsenal! "Practical Ransomware Detection (via Math, not AI)" 😁 🗓️ Today, Aug 4th 📍 Arsenal Station 4 Stop by if you're at Black Hat! More info: 🔗 blackhat.com/us-26/arsenal/…
Patrick Wardle
@patrickwardle
Jul 29
Wonder if this is what caused SentinelOne to start flagging Apple system binaries on macOS 26.6 as "suspicious threats" 👀🤔 H/T Matt Lee via LinkedIn: lnkd.in/p/dGFmbTr8
Patrick Wardle
@patrickwardle
Jul 27
macOS 26: the leaf cert. used to sign 🍎 -binaries is now "macOS Software Signing" (prev. "Software Signing"). Intermediate ("Apple Code Signing Certification Authority") & root ("Apple Root CA") unchanged. Relevant to some security tools (e.g. LuLu) that cared about this! 👀
Patrick Wardle
@patrickwardle
Jul 27
macOS 26: the leaf cert. used to sign 🍎 -binaries is now "macOS Software Signing" (prev. "Software Signing"). Intermediate ("Apple Code Signing Certification Authority") & root ("Apple Root CA") unchanged. Relevant to some security tools (e.g. LuLu) that cared about this! 👀
Patrick Wardle
@patrickwardle
Jul 27
Sometimes simple bugs are the best! 🙌🏼 "the PasswordManagerBrowserExtensionHelper binary logged the session PIN to the system log via os_log" 🔓🫠 Thanks for sharing your research/writeup @joshparnham 🙏🏽
Josh Parnham
@joshparnham
Jul 18
Published a writeup on CVE-2025-24169, a macOS vulnerability which allowed a malicious app to enumerate a user's saved account data in the Passwords app - contravening TCC protections. Example PoC + full details here: joshparnham.com/2026/07/access…