Apple’s 30 October spyware alerts reach a Beirut filmmaker and the German Bundestag

Apple sent a new round of mercenary-spyware threat notifications on 30 October, first flagged publicly by the researcher Costin Raiu, who noted it was unrelated to the August round. On Sunday 1 November, German federal digital minister Karsten Wildberger confirmed on ARD’s Bericht aus Berlin that there had been “a notification from Apple that certain devices may have been compromised with so-called spyware,” received by Bundestag members and federal government figures; Germany’s BSI issued guidance the following day saying recipients “should therefore assume that their device may have been compromised.” TechCrunch put the round at 99 countries, sourced to the text of a notification actually received by one recipient; TechSpot reported 110, without documented provenance. The 99 figure is the one with a paper trail, and it comes from the alert text rather than from Apple, which has made no public statement on scale.

The Middle East recipients are the part that matters here. Radwan Mortada, a Beirut-based filmmaker, said on X that he had received a notification warning that Apple had detected “another attack against your device,” following an earlier spyware attack against him in 2021. “Targeting journalists with spyware poses a serious threat to freedom of the press and the confidentiality of their sources,” he wrote, in Arabic. A Turkish journalist, Soylu, also went public, while saying he has no concrete evidence linking his case to this round. John Scott-Railton of Citizen Lab told The Record that “Apple Threat Notifications make accountability happen,” and noted Apple had made the alerts more visible in August 2026. Apple does not attribute and does not confirm actual compromise — the single most-abused nuance in coverage of these rounds.

Assessment: An Apple notification is a tripwire, not a forensic finding, and the distance between those two things is where most of the reporting goes wrong. Nobody has named the tooling, the vendor or the customer. That work is done later, typically weeks later, by Citizen Lab and Amnesty’s Security Lab, and the open question for readers here is whether any Gulf-origin or Israeli-origin tooling surfaces in that forensics. Note also how a number hardens: a count lifted from one recipient’s alert text is already circulating as an Apple disclosure, and a competing figure with no provenance is circulating alongside it. Within a week one of them will be cited as official.