A flaw in Safari – that allows an attacker to spoof websites and trick victims into handing over their credentials – has yet to be patched.
Source: Threadpost