HIGH/ OCTOBER 28, 2026TODAY’S BRIEFING — #222
Apple CoreGraphics exploited; PHP RCE hits 70% of sites; HPE critical patches
Apple's CoreGraphics zero-day exploited in real-world attacks across iOS/iPadOS; PHP memory-corruption RCE affecting ~70% of all websites now patched; HPE networking products have 8 critical RCE flaws. Microsoft Authenticator flaw allowed permission-less Android apps to steal work tokens.
CVE-2026-86950Apple Multiple Products — An out-of-bounds write issue was addressed with improved bounds checking. · In CISA KEVCVE-2026-109618PHP Group PHP — PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. · In CISA KEVCVE-2026-109619PHP Group PHP — PHP has various global state that temporarily points into request memory. · In CISA KEVCVE-2026-80097Microsoft Authenticator — Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Read the full briefing →