On November 10, 2026, Binance issued a warning to iPhone users about a newly documented iOS cross-app file-access vulnerability identified as worse_query. The flaw could allow malicious applications to read recovery phrases, private keys, and login credentials. Binance named iOS 26.7.1, 27.0.1, and 27.2 among affected versions.
The alert followed Apple’s November 9 release of iOS 27.2.1 and 26.7.3. However, Apple’s published security advisories do not explicitly confirm a fix for worse_query. Security researcher forcequitOS had published a proof of concept on November 8, describing it as an application sandbox escape. Apple’s sandbox normally restricts applications from accessing another app’s private storage, but the researcher’s GitHub repository lists accessible application, extension, and shared-container directories across iOS 26 and 27. The demonstration requires an App Group entitlement, a prerequisite often absent from generalized warnings, and forcequitOS called it a developer proof of concept rather than a jailbreak. This establishes a possible access path, not actual theft or universal access to wallet secrets.
Apple’s iOS 27.2.1 notes address unauthorized data access through App Intents, but neither advisory names worse_query or forcequitOS, and no confirmed public CVE mapping connects that fix to the demonstrated sandbox escape. Binance recommended that users remove untrusted applications—especially manually signed or sideloaded IPA files—update iOS and installed apps through official channels, and, if exposure is suspected, generate a fresh wallet on a clean device and transfer assets. Users should also reset affected login sessions, since reinstalling an application cannot revoke copied credentials.
In a separate review of crypto payout pricing published the same day, businesses were reminded that advertised zero-fee processing does not remove all costs. Providers compared included 0xProcessing and NOWPayments, both publishing 0% payout service fees, and CoinGate, which listed €0.50 plus 0.5% per crypto payout without conversion or €0.50 plus 1.5% with conversion. An illustrative batch of 1,000 payments of €10 under CoinGate’s standard tariff would produce a listed payout charge of €550, while the same €10,000 total across 100 payments of €100 would cost €100. The review emphasized that network fees, funding charges, conversion spreads, and recipient withdrawal costs can still apply, and that stablecoins such as USDT and USDC carry issuer, redemption, depegging, custody, and network risks.
