Apple Patches Actively Exploited CoreGraphics Zero-Day (CVE-2026-86950)
Apple released emergency updates for iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to fix an out-of-bounds write vulnerability in the CoreGraphics framework. The flaw (CVE-2026-86950) can lead to arbitrary code execution when a device processes a specially crafted file—potentially via web content, email, messages, or automatic previews.
Apple stated it is “aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” The issue was reported by Meta’s product security team. Newer releases (iOS/iPadOS/macOS 27) do not appear affected. Users on supported older versions should update immediately; the attack surface includes graphics and PDF rendering paths that can be triggered with relatively low user interaction in some scenarios.
Citrix NetScaler Zero-Days (CVE-2026-88771 & CVE-2026-88772) Actively Exploited Worldwide
Citrix confirmed two critical remote-code-execution zero-days in NetScaler ADC and Gateway (CVSS 9.5 each) that were already under active exploitation before public disclosure. CVE-2026-88771 is an improper input-validation issue allowing unauthenticated command execution on default configurations. CVE-2026-88772 is a memory overflow that can enable RCE or denial-of-service when DTLS is enabled (common on VPN virtual servers).
CISA added both to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by September 30 while performing forensic triage. Tens of thousands of internet-exposed instances were reported. Citrix released fixed builds (14.1-73.37+, 13.1-64.23+, and corresponding FIPS/NDcPP versions) along with six additional flaws. Organizations running NetScaler should treat this as an emergency: patch, check for webshells or other compromise indicators, and review exposure.
Storm-3168 (JadePuffer) Uses Compromised Azure Service Principals for Lightning-Fast Destructive Attacks
Microsoft detailed activity by Storm-3168 (linked to the agentic ransomware actor previously tracked as JadePuffer/JADEPUFFER). In one observed incident, two compromised Azure service principals conducted prolonged reconnaissance followed by a roughly seven-minute destructive phase that successfully deleted the majority of targeted storage accounts plus other resources (Key Vault, Function App, App Service plan).
The attackers also harvested storage-account keys and probed recovery protections. Resource locks and deletion protections blocked some deletions, underscoring their value even against highly privileged identities. Microsoft noted the activity resembles preparation for ransomware-style impact and observed repeated probing of Azure App Services from related infrastructure. Exposed credentials (including those previously leaked in public GitHub issues) appear to have played a role. The case highlights how machine identities with broad permissions can turn a single compromise into rapid, high-impact cloud destruction.
Kiteworks Patches Critical Flaw After Precautionary Global Shutdown
Secure file-transfer provider Kiteworks instructed customers to shut down systems over the weekend after receiving credible threat intelligence from federal authorities about a potential imminent attack. During the window the company identified and patched a critical vulnerability limited to its Advanced Forms feature (enabled for fewer than 1% of customers).
Hosted systems were restored with no evidence of compromise or exploitation. Self-hosted Advanced Forms customers were directed to contact support. The episode illustrates both the value of rapid, coordinated response to intelligence and the operational cost of precautionary shutdowns when zero-day risk is credible but unconfirmed.
Pentagon Confirms DMDC Breach Affecting More Than 3 Million People
A vulnerability in a Defense Manpower Data Center (DMDC) file-sharing system allowed unauthorized access to unencrypted personally identifiable information between October 2025 and July 2026. The breach exposed names, dates of birth, Social Security numbers, contact information, and in some cases military occupational specialties for approximately 2.76 million living individuals and 294,000 deceased persons.
DMDC discovered and remediated the flaw in mid-July. Officials report no current indications of misuse of the data and are offering identity-protection services. The incident raises both privacy and counterintelligence concerns given the sensitivity of the records held by one of the Pentagon’s primary personnel repositories.
These incidents collectively underscore persistent themes: zero-days in widely deployed edge and graphics components, the speed of agentic/cloud-identity attacks, the operational trade-offs of precautionary shutdowns, and the long-tail impact of delayed detection of privilege or data-access flaws.
Stay patched, monitor identity and cloud control-plane activity closely, and treat internet-facing appliances as high-priority assets.