macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools

A vulnerability in macOS's XPC inter-process communication architecture allowed standard, unprivileged users to disable enterprise security tools like CrowdStrike Falcon and Kandji MDM by exploiting CDHash caching and NIB injection to hijack trusted processes. This is particularly dangerous because the very tools designed to detect and prevent attacks were themselves the attack surface, effectively blinding defenders to subsequent malicious activity. The flaw highlights that security software running on a general-purpose OS inherits all of that OS's underlying vulnerabilities, and assumes a level of OS integrity that may not always hold. Responsible disclosure and prompt patching by both vendors prevented widespread exploitation, but the window between discovery and patch deployment represents a critical period of organizational risk.