radare2 6.2.4 improves Swift and ARM64 analysis and hardens its parsers

What happened on 2026-10-05

At 19:52 UTC on 2026-10-05, radare2 published 6.2.4 (codename "The Magnetician") on GitHub. The release page lists 6.2.2 as the previous version, with 453 commits from 18 contributors. Analysis is the largest section: a new Go calling convention, Swift defaults for Swift binaries, better ARM64 switch-table recovery and noreturn handling, arm64 DWARF location fixes, and preserved function prototypes during variable recovery. Pseudocode output now enables pdc.structured by default. Format work covers Mach-O weak imports, ELF relocations, faster PE export resolution and a fix for DEX comparison ops involving NaN. Security got a large hardening batch: sandbox enforcement for HTTP commands, out-of-bounds read fixes in parsers including APFS, PDB and Mach-O, and a shell injection fix in curl headers.

What it means for a defender's threat model

When a free, open-source tool keeps improving on Swift, Go and ARM64, the barrier to analyzing native mobile and desktop binaries keeps falling, and more structured pseudocode output is easier for both people and AI assistants to read. For defenders, the right conclusion is not that switching languages makes you safe. It is that faster analysis tooling shortens the time an attacker needs, so do not rely on obscurity. Writing core logic in Swift or Go just gives it a different analyzable shape. The many parser security fixes in this release are also a reminder that analysis tools process untrusted files. If your team examines samples suspected of imitating your app, run such tools in an isolated environment and keep them up to date.

Checks on your own builds

Review your releases on the default assumption that the binary will be understood. Inventory the native libraries in your package, check for leftover debug symbols or DWARF information, and confirm that release configurations strip them. Map the client-side functions that make licensing, billing or risk decisions, and assess whether the server could make those decisions instead, leaving the client with presentation logic only. If you use obfuscation or control-flow transformations, rerun functional regression and performance tests after every compiler or toolchain upgrade to confirm the transformation has not changed behavior. When your team uses analysis tools to inspect its own artifacts, run them in an isolated VM or container, and read the release notes before upgrading those tools.

Your checklist

• Inventory native libraries in your package and confirm debug symbols are stripped
• Move licensing and billing decisions to the server
• Run analysis tools in isolation and read release notes before upgrading