[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP4UUpgbqhmgJIdyXWctgFEh2PP_6vUfPA05pOGq_X2I":3},{"article":4,"iocs":43,"watch_terms":132,"solutions":133,"lesson":213},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3397606b-7b9e-409f-9fcd-bc6ff82b749c","Apple Patches for October 2026, (Mon, Oct 26th)","apple-patches-for-october-2026-mon-oct-26th-344bdc","Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.","Apple has issued patches for a significant number of vulnerabilities, totaling 304 in its latest update. Among these is CVE-2026-86950, a previously patched vulnerability in CoreGraphics that is now confirmed to have been actively exploited. This update addresses the issue across various Apple operating systems and products, including iOS, macOS, tvOS, watchOS, and Safari.","Apple releases patches for 304 vulnerabilities, including an actively exploited zero-day.","https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33458","https:\u002F\u002Fisc.sans.edu\u002Fimages\u002Flogos\u002Fisc\u002Flarge.png","2026-10-26T23:34:37+00:00","2026-10-27T00:00:33.243046+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"CoreGraphics","product",{"name":21,"type":19},"iOS",{"name":23,"type":19},"macOS",{"name":25,"type":19},"tvOS",{"name":27,"type":19},"watchOS",{"name":29,"type":19},"Safari","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},[44,48,51,54,57,60,63,66,69,72,75,78,81,84,87,90,93,96,99,102,104,107,109,111,113,116,118,121,123,126,129],{"type":45,"value":46,"context":47},"cve","CVE-2026-86950","Actively exploited vulnerability in CoreGraphics.",{"type":45,"value":49,"context":50},"CVE-2026-86990","Malicious app may access camera without user permissions.",{"type":45,"value":52,"context":53},"CVE-2026-28864","Local attacker may gain access to user's Keychain items.",{"type":45,"value":55,"context":56},"CVE-2022-26704","App may be able to gain elevated privileges.",{"type":45,"value":58,"context":59},"CVE-2026-112410","Remote attacker may cause an unexpected process termination.",{"type":45,"value":61,"context":62},"CVE-2026-112413","Processing a maliciously crafted file may lead to unexpected app termination.",{"type":45,"value":64,"context":65},"CVE-2026-112414","Processing a maliciously crafted message may lead to a denial-of-service.",{"type":45,"value":67,"context":68},"CVE-2026-112415","App may be able to cause unexpected system termination or corrupt process memory.",{"type":45,"value":70,"context":71},"CVE-2026-112416","Processing a maliciously crafted video file may lead to unexpected app termination.",{"type":45,"value":73,"context":74},"CVE-2026-112417","Processing a maliciously crafted 3D model may lead to memory corruption.",{"type":45,"value":76,"context":77},"CVE-2026-112421","App may be able to modify protected parts of the file system.",{"type":45,"value":79,"context":80},"CVE-2026-112423","Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.",{"type":45,"value":82,"context":83},"CVE-2026-112424","App may be able to cause unexpected system termination or read kernel memory.",{"type":45,"value":85,"context":86},"CVE-2026-112425","Processing a 3D model may result in disclosure of process memory.",{"type":45,"value":88,"context":89},"CVE-2026-112427","Remote attacker may be able to cause arbitrary code execution.",{"type":45,"value":91,"context":92},"CVE-2026-112428","App may bypass Gatekeeper checks.",{"type":45,"value":94,"context":95},"CVE-2026-112429","Processing a maliciously crafted file may disclose process memory.",{"type":45,"value":97,"context":98},"CVE-2026-112430","App may be able to gain root privileges.",{"type":45,"value":100,"context":101},"CVE-2026-112432","App may be able to access sensitive user data.",{"type":45,"value":103,"context":98},"CVE-2026-112434",{"type":45,"value":105,"context":106},"CVE-2026-112438","Unprivileged attacker may be able to execute arbitrary code as root.",{"type":45,"value":108,"context":101},"CVE-2026-112441",{"type":45,"value":110,"context":77},"CVE-2026-112442",{"type":45,"value":112,"context":68},"CVE-2026-112443",{"type":45,"value":114,"context":115},"CVE-2026-112444","App may be able to bypass Gatekeeper checks.",{"type":45,"value":117,"context":101},"CVE-2026-112446",{"type":45,"value":119,"context":120},"CVE-2026-112447","App may be able to bypass Privacy preferences.",{"type":45,"value":122,"context":74},"CVE-2026-112449",{"type":45,"value":124,"context":125},"CVE-2026-112451","Remote attacker may be able to cause a denial-of-service or disclose process memory.",{"type":45,"value":127,"context":128},"CVE-2026-112453","App may be able to break out of its sandbox.",{"type":45,"value":130,"context":131},"CVE-2026-112454","Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.",[18,21,23],{"controls":134,"vendors":206},[135,164,192],{"slug":136,"name":137,"problem":138,"products":139},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[140,148,156],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":165,"name":166,"problem":167,"products":168},"patch-management","Automated patch management","Known holes get closed in days, not months.",[169,177,185],{"vendor_slug":170,"vendor_name":171,"vendor_logo":172,"product_slug":173,"product_name":174,"url":175,"description":176},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":178,"vendor_name":179,"vendor_logo":180,"product_slug":181,"product_name":182,"url":183,"description":184},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":186,"vendor_name":187,"vendor_logo":188,"product_slug":165,"product_name":189,"url":190,"description":191},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":193,"name":194,"problem":195,"products":196},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[197,198],{"vendor_slug":178,"vendor_name":179,"vendor_logo":180,"product_slug":181,"product_name":182,"url":183,"description":184},{"vendor_slug":199,"vendor_name":200,"vendor_logo":201,"product_slug":202,"product_name":203,"url":204,"description":205},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[207],{"slug":208,"name":209,"logo_path":210,"roles":211},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[212],"affected",{"slug":214,"title":215,"body":216,"framework_refs":217,"framework_notes":225},"apples-304-vulnerability-patch-batch-includes-actively-exploited-coregraphics-flaw","Apple's 304-Vulnerability Patch Batch Includes Actively Exploited CoreGraphics Flaw","Apple's October 2026 update addresses 304 vulnerabilities across its entire product ecosystem, including CVE-2026-86950, a CoreGraphics vulnerability that had been previously patched but is now confirmed as actively exploited in the wild. This highlights a dangerous pattern: threat actors routinely reverse-engineer patches to develop exploits, meaning any delay in applying updates creates a critical window of exposure. The breadth of affected platforms — iOS, macOS, tvOS, watchOS, and Safari — underscores how a single unpatched vulnerability can have cascading risk across an entire device fleet. Organizations and individuals who lag on applying Apple updates are directly exposed to confirmed, in-the-wild exploitation.",[218,219,220,221,222,223,224],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":226,"PCI DSS Requirement 6":227,"NIST SP 800-53 SI-2: Flaw Remediation":228,"OWASP A06:2021 Vulnerable and Outdated Components":229,"CIS Control 7: Continuous Vulnerability Management":230,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":231,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":232},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the confirmed active exploitation of a previously patched flaw signals a gap in the vulnerability lifecycle management NIS2 demands.","Requirement 6 mandates that organizations protect systems against known vulnerabilities by installing applicable security patches within defined timeframes, which would have enforced timely application of the CoreGraphics fix.","SI-2 requires organizations to identify, report, and correct information system flaws promptly — a formal flaw remediation process tied to patch release timelines would have closed this gap across Apple's product range.","CoreGraphics is a foundational OS component; running unpatched versions of system-level libraries is precisely the risk OWASP A06 warns against, as attackers target known flaws in widely deployed components.","CVE-2026-86950 had already been patched once; a continuous vulnerability management program with mandatory patching SLAs would have ensured the updated fix was applied before active exploitation could occur.","This control specifically mandates timely identification and remediation of technical vulnerabilities, directly addressing the failure to apply the prior CoreGraphics patch before it was actively exploited.","While primarily a patching issue, CoreGraphics exploits can be used to escalate privileges or bypass access controls — enforcing least-privilege and monitoring anomalous process behavior would limit the blast radius of successful exploitation."]