Apple has reversed its position and patched the "carpet bombing" flaw in its Safari browser. Apple has reversed course and patched a bug in its Safari browser after security researchers showed how it could be used to run unauthorized software on a Windows machine.The “carpet bomb” bug, which was originally discovered by security researcher Nitesh Dhanjani, was initially thought to be less serious than it turned out to be.Dhanjani showed how Safari could be misused to litter a victim’s desktop with downloaded programs, but two weeks after he disclosed his research, another hacker, named Aviv Raff, showed that this flaw could be exploited in tandem with other problems in Windows and Internet Explorer to run unauthorized software on a victim’s PC.That prompted Microsoft to issue its own warning about the issue. It also caused some security experts to caution Web surfers about using Safari on the Windows platform. According to Dhanjani, Apple initially told him that it did not intend to fix the issue, but apparently the company has now changed its mind.Apple fixed the issue in the 3.1.2 version of its Safari browser for Windows, which was released Thursday afternoon. This update addresses a total of four security issues in Safari, including bugs in the way Safari renders JavaScript arrays and handles the downloading of executable files. It also fixes a less-critical issue in the way Safari renders Bitmap and Gif images, which could give attackers a peek at the memory of a victim’s computer, Apple said.Thursday’s update was for Windows computers only, and Apple has not yet released a 3.1.2 Safari update for the Mac. Related content brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security news Gitlab fixes bug that exploited internal policies to trigger hostile pipelines It was possible for an attacker to run pipelines as an arbitrary user via scheduled security scan policies. By Shweta Sharma Sep 21, 2023 3 mins Vulnerabilities Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe