🚨 ACTIVE EXPLOITATION
- Apple backports zero-day fix for exploited CoreGraphics flaw to older iPhones and iPads
Apple has backported a fix for an actively exploited zero-day vulnerability to older iPhones and iPads running iOS 18.7.11 and iPadOS 18.7.11.- Affects iPhone XS/XS Max/XR, iPad 7th generation and later, iPad Air 4th gen and later, iPad 9th gen and later, and iPad mini 6th gen and later on iOS/iPadOS 18.7.11.
- The flaw is an out-of-bounds write in CoreGraphics (CVE-2026-86950) that allows arbitrary code execution when processing a maliciously crafted file.
- Apple says it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- The advisory also fixes an information leak (CVE-2026-65339) and a CoreMedia camera access issue (CVE-2026-86990).
Sources 📄 Source: support.apple.com · 📎 Coverage: techconnex.westcon.com · 👁 via @zackwhittaker@mastodon.social
💥 BREACHES & INCIDENTS
- DreamHost forces email and FTP/SFTP password resets amid ongoing incident
DreamHost has forced password resets for email and FTP/SFTP users following an incident that took its File Manager offline.- Affects DreamHost customers with email, webmail, and FTP/SFTP accounts; the company serves over 400,000 customers and hosts 1.5 million websites, including 750,000 WordPress installations.
- File Manager at files.dreamhost.com went offline and some webmail users were signed out starting October 23, 2026; File Manager was restored October 26 and is being monitored.
- As a precaution, DreamHost expired passwords for a subset of email and FTP/SFTP users, who cannot log in until account owners set new credentials via panel.dreamhost.com.
- DreamHost advised users to review email forwarding rules for unrecognized destinations, suggesting some email accounts may have been breached; the company has not confirmed details or responded to press inquiries.
- Recovery instructions were emailed to all affected account owners in batches; the incident remains under investigation with no root cause disclosed.
🕵️ RESEARCH & DEEP DIVES
The Gentlemen RaaS: fast-scaling Qilin splinter group claims 800+ victims with 90% affiliate split
The Gentlemen, a Russian-speaking ransomware-as-a-service group that split from Qilin in mid-2025, has rapidly become one of the top ransomware threats with 800+ claimed victims.- Targets organizations worldwide, especially in the US and Europe; most-hit sectors are manufacturing, technology, healthcare, professional services, and retail; CIS operations prohibited.
- Offers affiliates an unusually generous 90/10 ransom split (only RansomHub previously matched it), driving rapid affiliate growth; formed after a July 2025 payment dispute between Qilin affiliate 'hastalamuerte'/ArmCorp and Qilin over ~$48,000.
- Go-based ransomware targets Windows, Linux, NAS, and BSD, with a dedicated C-based ESXi locker; uses double extortion (encryption plus data exfiltration), per-file ephemeral keys, intermittent encryption of large files, and a mandatory build-specific password argument.
- Primary initial access is exploitation of CVE-2024-55591, a FortiOS/FortiProxy authentication bypass; operators reportedly hold a stockpile of ~14,700 compromised FortiGate devices and ~1,000 brute-forced VPN credentials, and also use RDP, SSL VPNs, NTLM relay, and stolen OWA/M365 credentials.
- Uses aggressive defense evasion including EDR-killing via BYOVD (vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers), disabling Windows Defender real-time monitoring, deleting shadow copies, snapshots, and event logs, and lateral movement with AnyDesk and PsExec.
Heap overflow found in EDK2's Brotli decompressor, unfixed sibling of CVE-2021-28211
A researcher disclosed an unfixed heap buffer overflow in EDK2's BrotliCustomDecompressLib, present since 2017.- Affects EDK2's MdeModulePkg/Library/BrotliCustomDecompressLib (BrotliDecompress.c), unfixed at HEAD as of 2026-10-25.
- BrotliUefiDecompressGetInfo truncates a UINT64 decoded size to UINT32 with no MAX_UINT32 guard (line 238), and BrotliDecompressInternal decompresses into the destination buffer unbounded.
- An attacker controlling the firmware image (flash, capsule, or ESP) gets a heap write primitive in the DXE phase before Secure Boot verification completes, able to overwrite adjacent pool objects like function pointers and security flags.
- The bug is the overlooked Brotli sibling of CVE-2021-28211, which fixed the identical pattern in the LZMA decompressor in 2021; a variant sweep found Brotli is the only EDK2 decompressor lacking both guards.
- Blast radius is narrow: scans of 200 shipping LVFS firmware images found zero using Brotli GUIDed sections (LZMA appeared in 161/200), so the vulnerable code appears to be dead code today.
- Disclosed publicly on 2026-10-26 with ASAN proof-of-concept and controlled-corruption demo; no CVE assigned and no coordinated disclosure period was given to TianoCore.
📋 ADVISORIES
Cloudflare fixes cross-request KV cache exposure in GLM-5.3 Workers AI model
A configuration mismatch in GLM 5.3 on Cloudflare Workers AI triggered an SGLang bug that exposed KV cache pages across requests.- Affects users of the GLM-5.3 model on Cloudflare Workers AI.
- A configuration mismatch triggered a bug in SGLang that exposed KV cache pages across different requests.
- Cloudflare has remediated the issue and published a post-mortem describing the fix.
📄 Source for University of Copenhagen breach exposes personal data of 525,000 people — news.ku.dk
📄 Source for 953 Online Stores, Mostly Magento, Infected With Scanner-Evading JavaScript Loaders — sansec.io