Apple’s iCloud Private Relay is back to private status, after an apparent fix in iOS 26.6.1 patched the vulnerability that would expose a person’s IP address even when the feature was enabled.
iCloud Private Relay is a paid feature available only to those with an iCloud Plus subscription. When it’s active, it routes web traffic through proxy servers to mask your physical location and web traffic. It’s specific to Apple’s Safari web browser and apps that use Apple’s WebKit framework, and is not the same as a VPN, which hides all internet traffic.
Earlier in August, developers Talal Haj Bakry and Tommy Mysk noticed that Apple devices with iCloud Private Relay enabled could still leak their IP addresses in three circumstances. The developers set up a web page at leaks.psylo.app where you could check whether you’re vulnerable.
On Tuesday, Mysk posted on X that Apple’s iOS 26.2.1 release (and the 26.2.1 releases of Apple’s other operating systems) is where the fix appeared, even though it’s not noted in Apple’s security release notes. Now, if you go to that leaks page, it reports the masked IP address, not the actual address, of the device you’re running. You need to have iCloud Private Relay on in Settings > iCloud.
Mysk also noted in a reply on X that, “It’s near to impossible Apple would have addressed this issue so quickly had we reported it to Apple first. As expected, they only fixed it for Safari.”
An Apple representative didn’t immediately respond to a request for comment.
Soon after its existence was revealed, the iCloud Private Relay vulnerability prompted a lawsuit by Clarkson Law Firm, the same outfit that negotiated a $250 million settlement with Apple over how the company advertised its Apple Intelligence features at launch. The firm has also recently sued smart ring maker Oura.
A Clarkson Law Firm representative didn’t immediately respond to a request for comment.
See full bio
Read the full article here
