Apple web server security acknowledgements

Apple publishes this article to acknowledge and thank those who reported potential security issues in our web servers. Credit is added after the issue has been identified and addressed.

For Apple web server security acknowledgements from previous years, see the end of this article.

Credits

February 2026

A Josman Pratama

Aidan Preston

Alex Bas (@phr0ph)

Alexander Landegge

Aliaksandr Zasinets

Aman Gupta

Anas Nady

Balogun Ismail Ayokunle

Codermak

Daniel Melikyan

Darya Hakeem Abubaker & Ahmed Syed

Gibson Bell

Hacktron AI

Hashim Al-Jabery

Hussein Daher (@hussein98d)

HusseiN98D & Sicarius

Juan Sukaton

k3mlol

Karan Rathod

Kayode Israel Ayoola (Slimjhay)

Liam Marc Sowden

Mahmoud Samaha (0x4m)

Mahmud Hasan Sizan

Mangesh Muley

Miguel Llamazares Hidalgo

Mohammad Kaif (@_mkahmad)

Nathaniel Oh (@calysteon)

Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

Rafael Nadal Simó - Dominican Republic

Sahar Shlichove

Shaikh Yaser Arafat

Shoeb Shaikh (ishoeb0x1)

todayisnew / @codecacare

Vamshi Krishna Upadrasta

Walid Bouakka

xsstestov

Yunus Oyetunde (Coy Emerald) - CEO of O-range Cybersecurity Training & Services Ltd

Zaid Ali Hussein Albu-Mohammed

栋梁 陈

January 2026

• Abhi Rantia Dharmawan

• Aidan Preston

• Arshith A

• Darya Hakeem Abubaker & Ahmed Syed

• Devansh Chauhan (Threatvapt)

• Dmytro Bolychevskyi

• Dmytro Korzhevin (Cisco Talos)

• FARIDH WAJLI

• Gangadevi Yoga Bhanu Prakash

• HAMOUD ALHALMANI

• Hanif Maulana Trangginas

• Jasminder Pal Singh, Team WSP - Kotkapura

• Kayode Israel (Slimjhay)

• LamBui, trungkay

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Lehan Dilusha Jayasinghe

• Luca Ercoli

• Mahmoud Samaha (h1:0x4m)

• Maulana Riski Dwi Putra

• Mohammad Kaif (@_mkahmad | kaif0x01)

• Mohd Haji

• Mustafa mahdi salleh

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Nishan Shill

• Noman Shaikh (@nomanAli181)

• Noor Mohammad Gagguturi

• null1433

• Olayiwola Stephen Oladolapo (Cyberkariot)

• ridoy mia

• suga

• Tirtha Mandal

• Vamshi Krishna Upadrasta

• Wilson Chen

• Yunus Oyetunde (Coy Emerald) - CEO of O-range Cybersecurity Training & Services Ltd

• zainab ali

December 2025

• Abdullah Ahmet ERDEM

• Abhijeet Kumar Sarkar

• abidakun samuel

• Aderonmulo Ariyo (Mudhaxk)

• Ahmad Abubakar

• Akshay Krishna (AkSec)

• Akshay raj

• Alfiya Naz

• Ankur Bakre

• Arun Malik

• Bipin Saud (CryptoGen Nepal)

• buf snake

• Dmytro Bolychevskyi

• Duong Ton Hoang Khang of Sacombank, Nguyen Khanh Hao of HPT Vietnam Corporation

• Frans Rosén (@fransrosen)

• Gustavo Saez Ferreira

• HusseiN98D & Sicarius

• Ife F.

• Joel Ahlstedt

• Kang Ali

• Khalafallah Altayeb Mohammed

• Kyaw Min Thein

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Lyra Rebane (rebane2001)

• M Easwari

• Mahmoud Samaha (0x4m)

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Ori Levi

• Pentester

• Priyanshu Parihar & Dilip Singh Solanki (Matrix Softsec LLP)

• Rijul JenJen (Breach Guardians, Bavaria, Germany)

• Sindhu Raj Neupane

• Tirtha Mandal, Rodolfo Assis

• todayisnew / @codecancare

• Trivikram Sundarmurthy Prashanth of Waterfall Technologies Ltd

• Vamshi Krishna Upadrasta

• Vishnu P Das

• Yauheni Savushkin

• Zin Min Phyo

November 2025

• Aaron Perris (@aaronp613)

• abderrahmane aksoum

• Adam Skinner & Matt Head

• AditiaAlfiki X Satrio Utomo Noerwahyu - Indonesia

• Alan Jose

• Alex Bas (@phr0ph)

• Aman Gupta

• Arber Kadriu

• Darius hackchief

• Dmytro Bolychevskyi

• Mohammad Ahmad Sayyed

• Nemanja Mikic

• Nishant Bhagat

• p4fg

• Sahil Sehgal (sehgalsec)

• Shalvi Patidar (@shalvipatidar) & Hemant Patidar (@hemantsolo)

• Simon Schwarz

• suga

• todayisnew / @codecancare on Twitter

• Tuntin9x (Red Team - VNCS Global)

• Vaibhav Nitin Gaikwad

• Valerio Brussani

• ytaufiq

• Yunus Oyetunde (Coy Emerald)

• 琦 伍

• 西瓜(@ForOne)

October 2025

• 0xdln

• Abdullah Ahmet ERDEM

• Adam Skinner & Matt Head

• Alex Bas (@phr0ph)

• Buduru Naveen

• 陳宥升(CheN..)

• chybeta

• Codermak

• CraftByte

• Dhiyaneshwaran Balasubramaniam

• erickfernandox

• Erik Paula

• Genadi Shamugia

• Guman Rajpurohit

• Ithrael

• Jasminder Pal Singh

• Jerin Albert

• Karem Elsqary

• Karan Rathod

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Mayur Sanjayrao Gandole

• Michael Ness

• Namrit Singh

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• null1433

• Olaoluwa Oyewale

• Omkar Magar

• Onyebuchi Osani

• Raghav Kuinkel

• Reza Sarvani

• Rishi Mohandas

• Sagar Yadav (@sagaryadav8742)

• Sahil Hiraman Dabhilkar

• Salah Eddine louffidi

• Sameer Ahmad

• Santosh Bobade

• Sebastian Stallenberger

• Shaikh Yaser Arafat

• Shivam Dhingra

• Shivansh Khare

• suga

• Sumit Grover

• Tony Tunde Obisesan

• Tuấn Ngô sỹ

• Uche Nweke (hackchief)

• Vijay Kumar

• Vivek Goswami

• Yakubu Umar Yaro – Independent Security Researcher

• Yaswanth sai Boligarla

• Yunus Oyetunde (Coy Emerald) - CEO of O-range Cybersecurity Training & Services Ltd

• Zhongcheng Li from IES Red Team of ByteDance

September 2025

• Aditya Alfikri

• Ajay Kakasaheb Pandit

• ak-1337

• Akshay raj

• Alex Bas (@phR0ph)

• d0xing

• Devansh Chauhan (Threatvapt)

• Devender Rao

• dimas aprilianto

• Dmytro Bolychevskyi

• Eng.Ali & Dr.mina > 224

• Erik Paula

• Gal Nagli, Rami McCarthy - Wiz Research

• geo momo

• hamza sais

• Hao Wang & Caleb Sargent

• Hasnain Ghoghari

• Iman Gurung

• Jivan Magare ( Solo )

• Kayode Israel (Slimjhay)

• Kiril Krivoguz

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Matt Slaughter

• Mohammad Kaif (mkahmad | kaif0x01)

• Muthu D

• Namrit Singh (@namrit___)

• Nathan Boyle

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Oliver Schulz

• Pethuraj M

• Raghav Kuinkel

• Raghuram Gopalakrishnan

• ram lal

• Sagar Kumar

• Santhosh Kumar

• SOUHAIB NACERI

• Sourav Newatia

• suga

• Taylan Ozgur Bildik

• Tirtha Mandal

• tranvannam186

• Uebercracker

• Vamshi Krishna Upadrasta

• VHAE04 - CMC

• vijay kumar chippa (Coforge)

• Vishnu P Das

• VIvek Goswami

• YOGESWARAN M

• Yunus Oyetunde (Coy Emerald) - CEO of O-range Cybersecurity Training & Services Ltd

• Yusup Supriyanto

• 세연 황

August 2025

• 0xdln

• Aaron Perris (@aaronp613)

• ABDUL RAZACK KT

• Abdulazeez Abdulkadir

• Andrea Riva

• arjun shetty

• Aytaç Kalıncı

• bavly

• Bhushan Chavan

• Buvaneshvaran K (Ethical Hacker)

• Chi Yuan Chang of ZUSO ART and taikosoup

• Devansh Chauhan

• dimas aprilianto(Dimasaprilian993)

• Farras Givari

• Frans Rosén (@fransrosen)

• Gaurav Baplawat

• Guman Rajpurohit

• Hasnain Ghoghari

• hipotermia

• islam mokhles

• J. Domingo Carrillo Lencina

• Jivan Magare ( Solo )

• Joel Verghese (@krizzsk)

• Johnlee Shepard

• k3mlol

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Lyra Rebane (rebane2001)

• Mahmud Hasan Sizan

• Markus Tirrenberg

• Mohamed Shameem PA

• Naresh R

• Nguyễn Khánh Hào

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• null1433

• Paul Lannes

• Piotr Liśkiewicz (@nch3)

• Punit saini & Ravi kumawat

• QuyetNguyen, ToanNguyen, DucNguyen - RedTeam IVNSEC

• Salih Dumlu

• Samet Gozet

• sandeepv

• Shaul Ben Hai

• sourav chakraborty

• Sourav Newatia

• Subham Chatterjee & Rishi Arora

• Thomas B

• todayisnew / @codecancare on Twitter

• Uebercracker

• Vinche.zsh

• Vishal kumar (Thread Security)

• Yunus Emre Oztas

• Zaid Ali Hussein Albu-Mohammed

• Zazie Kanwar-Torge

July 2025

• @Youssef Desouki

• Aaron Perris (@aaronp613)

• Abdulaziz Alzahrani

• Alan Jose

• Ali Toni

• Ariel Rachamim

• Atul Nagaraj Nambiar

• Ben McEwan

• Buduru Naveen

• deepak deepak

• Harshita Bhatia | Yukti Ghablani | Chinmay Raj Pandey

• Heitor Gouvêa

• Hemant Patidar

• Hussein Daher

• Itachi22 and PwnForCard

• Joel Verghese (@krizzsk)

• Kürşad ALSAN @kursadalsan

• Lam Scun

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Lehan Dilusha Jayasingha ( Sri Lanka)

• lud v1k

• Mahmoud Samaha (Hackerone:0x4m)

• Mahmud Hasan Sizan

• Mohamed Tarek

• mohd haji

• MUHAMMAD ZAID GHIFARI { Mr.ZheeV } || Kalimantan Utara ||

• Namita Dhekula

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• p4fg

• Ravee Dandage

• Richard Hyunho Im (@r1cheeta)

• Rio Mulyadi Pulungan

• Rohit Sharma (r0x5r)

• Shivansh Khare

• Shubham Singh

• Sourav Newatia

• suga

• Uebercracker

• Yunus Oyetunde

• देवेन्द्र (@raoshaab)

June 2025

• abdellah kouba (@koubaabdellah)

• ABDUL RAZACK KT

• abidakun samuel

• Aderonmulo Ariyo (Mudhaxk)

• Aditya Alfikri

• AKHIL C D (@akhil-c-d-661abb292) || INDIA

• Alex Bas (@phr0ph)

• Alexandre Araújo (@xande_araujo) - RaDiTZz

• Atul RV

• Bryce Kwon

• Buduru Naveen

• Colin J Cohen

• Devansh Chauhan (Threatvapt)

• facemayne

• Gaurav Bhatia

• Gerson Aldaz

• hamza sais

• Hasnain Ghoghari

• Ithrael

• Jason of Null Consolidated

• junaid farhan

• k3mlol

• LawSoul from SentinelX (SSC - Cyber Security Unit - CMC Telecom)

• Leandro Chaves

• Mahmoud Samaha (0x4m)

• MD Sagor Hossain

• Mohd Hasan Ansari aka Jerry1319

• Muataz Hasan

• Muthu D

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Peter Goldsmith

• Pradipta Das

• Raghuram Gopalakrishnan

• Rajdip Dey Sarkar

• Samet Gozet

• SOUHAIB NACERI

• Sourav Newatia

• taha elias

• todayisnew / @codecancare

• Valdrin Haliti – Student, Universum College, Ferizaj, Kosovo

• Vikas Anil Sharma

• Vivek Goswami And Rohti Kamble

• zano_security(tech_talent)

• Zoltán Dr. Kulcsár

May 2025

• @Youssef Desouki

• 0xdln

• Abd-Hakeem Akinlawon

• Abdelrahman Ibrahim Farg

• ABDUL RAZACK KT

• Achraf Battou (@40rbidd3n)

• Ahmed Adel Abdelfattah

• Ajay Kakasaheb Pandit

• Alan Jose

• Asaf Afruzfar

• Curtis Carmony from Palo Alto Networks

• d0xing

• Daniel "V" Morais

• Devansh Chauhan

• Dinar Guluzada

• Dmytro Shedin

• Drake Jordan

• Filbert Alfredo Saputro

• Furkan Semiz

• Guillermo Gregorio

• Jaydev Ahire

• Kiril Krivoguz

• LawSoul from SentinelX ( RedTeam - Cyber Security Unit - CMC Telecom)

• Maikel Zweerink

• Marc-Oliver Munz (@marcolivermunz)

• Marco Lopes

• Mindaugas Liudavičius

• moein abas

• mohammed abdelmeguid

• Namita Dhekula

• Nathan Accacio (mor1arty)

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• null1433

• Pacman255

• Piotr Liśkiewicz (@nch3)

• Raagul Vignesh R

• SaifAllah benMassaoud

• Salih Dumlu

• Samarth Pohekar

• Sameer Rathod

• Sourav Newatia

• Thai Vu

• Tianhao Yang

• todayisnew / @codecancare

• Vansikha Singh

• ytaufiq

• Yunus Oyetunde

April 2025

• 0xdln

• Aderonmulo Ariyo (Mudhaxk)

• Alex Bas (@phR0ph)

• Alex C.

• Alexandre Araújo (@xande_araujo) - RaDiTZz

• Andrew Goldberg of The McCombs School of Business, The University of Texas at Austin

• Aravind S

• Asadul Islam

• Buduru Naveen

• Farras Givari

• Filip Bukovina

• Frederik Schwan

• hamza sais

• Husain Saleem

• iman Gurung

• J. Domingo Carrillo Lencina

• Jayanth K Atreya and Subiksha M (AKATI Sekurity)

• Jesse Nolan of Jamf Software

• Joel Verghese (@krizzsk)

• Joseph Chekanoff

• Kenta Okumoto

• keshav yadav

• Kiril Krivoguz

• LawSoul from SentinelX ( SSC - Cyber Security Unit - CMC Telecom)

• Lucas de Souza Silva (lucsouza)

• Martin van Wingerden

• MIN YOONGI

• Nguyễn Hoàng Minh (sn00py_z0r0), tuntin9x

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Niraj Mahajan

• Pethuraj M

• Rizki Maulana

• Shahariar Salman Shahed

• Utsavpari Gosai

• Vijay Kumar Chippa (Coforge)

• Yunus Oyetunde

• 陳宥升(CheN..)

March 2025

• Abdelrahman Ibrahim Farg

• Abhishek Pal

• Aditya singh ( @aditya-singh4180 )

• Adrian Tirado

• Akshay raj

• Anonymous M

• Artan Mulhaxha

• Ashkan Shahabi (@ashbi)

• Ashwin Gupta

• ayamkambing

• Azam Gassim Osman Abdalmahmoud ( @azam_gassim )

• Ben Lesser

• Ben McEwan

• blinxsstest123

• Buvaneshvaran K (@iambuvanesh)

• Collin Potter

• Dung Le (LTiDi) of FlySec

• Greg Long

• HIMURA KENSHIN

• inuma cybersecurity

• ismail Şentürk

• jaykant

• Jivan Magare ( Solo )

• Jon Colston (mayonaise)

• Josekutty Kunnelthazhe Binu

• karan kadu

• keshav yadav

• Khalafallah Altayeb Mohammed

• khoadha (Viettel Cyber Security)

• Kyaw Min Thein

• Leandro Chaves

• Mohd Hasan Ansari aka Jerry1319

• Oliver Schulz

• Rona Febriana

• Sabarinath Panikken

• Sagar Yadav ( @sagaryadav8742 )

• salah eddine louffidi

• Shivam Dhingra

• SOUHAIB NACERI

• Sourabhkumar Mishra

• ThanhLam17, Tuntin9x (Red Team - VNCS Global)

• Triffin Augustine ( TrffnSec )

• tuo4n8 (Verichains Cyber Force)

• Utsavpari Gosai

• Vishal Vishwakarma

• Yasser Ezzat (@YasserGersy)

• Yunus Oyetunde

February 2025

• Abbas Hamzayev

• Ahmed Alwardani of Sirar by stc

• Ahmed Yasser (kamananaa)

• Alex, Tuntin9x (Red Team - VNCS Global)

• Alex Bas (@phr0ph)

• Aryawardhan Singh (0x2458)

• Asadul Islam

• Chirag Saini

• cyal1 (@zenmen)

• d0xing

• Daniel Nogueira D'Aquino Fonseca

• Dimitrios Vlastaras

• Dung Le (LTiDi) of FlySec

• Frans Rosén (@fransrosen)

• hamza sais

• Harshad Subhash Pawar

• Ithrael

• José Pedro Pereira Junior

• Kirtikumar Anandrao Ramchandani

• LamBui, Tuntin9x (Red Team - VNCS Global)

• Mahmoud Samaha

• Mohd Haji

• Namita Dhekula

• Ngọc Hoa Lê

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Ori Levi & Maor Dayan

• Pablo García Pérez

• Rıza Sabuncu - Buğra Eskici

• Sakil Hasan Saikat

• Santhosh Kumar - TraceX Labs

• Sergen Koç

• Sourav Newatia

• Sriharan Mahendran

• tea tsjs

• Thai Vu

• Trần Đức Khiêm

• Vaibhav Jain

• Vaishali Thakur

• Vikas Anil Sharma ( Agilehunt - Guarding your innovation )

• Vishal kumar

• Yunus Oyetunde

• Zaid Mountacir

• 晴天组织<舞舞舞>@dukang

January 2025

• 0xdln

• Ahmed Yasser (kamananaa)

• Ananta Nadapara & Snehil Shourya

• Ashish Rai

• Biswajeet Ray

• Chan Nyein Wai

• Charan Kumar J

• d0xing

• Devansh Chauhan (@devanshchauhan_)

• Frans Rosén (@fransrosen)

• Hamza Sais

• Hashim Al-Jabery

• Ivarsatierf -- @rvsatierf

• Khiem Tran (@duckhiem)

• Kislay Kumar

• Kürşad ALSAN @kursadalsan

• Kush Sehra (@infosec1999)

• LawSoul from SentinelX ( RedTeam - Cyber Security Unit - CMC Telecom)

• Leandro Chaves

• Manthan Mahale

• Miguel Segovia Gil from EY GDS

• Mohammad Kaif (mkahmad | kaif0x01)

• Mohd Hasan Ansari aka Jerry1319

• Muthu D

• nader jendoubi

• Nguyen Van Hung (Itachi22) from SentinelX (Cyber Security Unit - CMC Telecom - RedTeam)

• Nilabh Rajpoot

• Nilesh Agrawal Koyo

• Parag Bagul

• Pruthu Raut

• Salah Eddine Louffidi

• Shivam Sharma (@Comrade)

• Sourav Newatia

• Subham Chatterjee

• Subhi Abualsayed

• todayisnew / @codecancare on Twitter

• Vedavyasan S (@ved4vyasan) Of CAS (IHRD) KOTTARAKKARA

• Vikas Anil Sharma

• Vishal Vishwakarma

• Vivek Goswami

• Yunus Oyetunde

• देवेन्द्र (@raoshaab)

Apple web server security acknowledgements from previous years

• Apple web server security acknowledgements, 2023-2024

• Apple web server security acknowledgements, 2021-2022

• Apple web server security acknowledgements, 2019-2020

• Apple web server security acknowledgements, 2017-2018

• Apple web server security acknowledgements, 2016

• Apple web server security acknowledgements, 2015

• Apple web server security acknowledgements, 2014

• Apple web server security acknowledgements, 2013

• Apple web server security acknowledgements, 2012

• Apple web server security acknowledgements, 2011

• Apple web server security acknowledgements, 2005-2010