The Patching Friars' AlmanacA calendar of CVE saints

March 18

DarkSwordHoly card for darksword, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 DarkSword SEX GLADII, UNUM VULNUS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint DarkSword, Chain of Six Blades

Patron of phones kept up to date, decoy websites, and anyone browsing on hostile networks.

Life

On 18 March 2026 Google, iVerify and Lookout jointly published research on DarkSword, an iPhone exploit chain that, according to the researchers, strung together six vulnerabilities, three of them in WebKit, to hit iOS from 18.4 to 18.7. It was delivered through watering-hole attacks: legitimate sites silently loaded an iframe that handed the chain to visitors. Apple had already fixed the flaws across a series of updates.

Prayer

O Saint DarkSword, who forges six blades for a single wound, keep our phones updated and our websites clean. Amen.

How to celebrate

Celebrated by updating iOS to the latest version, turning on Lockdown Mode for those most exposed, and distrusting compromised sites.

Six blades together, a single wound.

Technical record

Disclosed on
March 18 2026
CVE
CVE-2025-31277CVE-2026-20700CVE-2025-43529CVE-2025-14174CVE-2025-43510CVE-2025-43520
CVSS
8.8Actively exploited (CISA KEV)
Product
Apple · Safari

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Sources: lookout.com · cloud.google.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.