Apple patches critical Hide My Email vulnerability

Apple has patched a critical security vulnerability in its Hide My Email service that for over a year allowed anyone to discover a user's real email address, undermining the core privacy promise of the feature. The company deployed a fix on July 3, 2026, after the flaw was publicly disclosed earlier this month, though researchers warn that addresses created before July 7 may remain exposed in third-party email server logs.

The vulnerability was first reported to Apple by security researcher Tyler Murphy, co-founder of EasyOptOuts, in June 2025. Apple investigated and claimed to have addressed the issue in March 2026, but Murphy found the flaw remained exploitable. After further communication and with Apple still investigating, Murphy contacted journalists in late June 2026, leading to public reporting at the start of July. This disclosure prompted Apple to deploy the definitive patch on July 3.

The flaw exploited the forwarding mechanism of the Hide My Email service. When a message sent to a Hide My Email address was automatically rejected as spam by the recipient's final email host, the resulting bounce-back message or mail server log could reveal the real email address behind...