erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: September 28, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Patch this week: Apple CoreGraphics CVE-2026-86950: Exploited Zero-Day. Anyone managing iPhones, iPads or Macs still on iOS/iPadOS 26 below 26.7.1, macOS Tahoe below 26.7.1 or macOS Sequoia below 15.8.1, most urgently devices used by executives, journalists, administrators and others likely to be singled out.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2026-86950

Apple CoreGraphics CVE-2026-86950: Exploited Zero-Day

A targeted file-parsing zero-day with a fix out since September 28: confirm every iPhone, iPad and Mac is on 26.7.1, 15.8.1 or a 27.x release this week, and today for high-risk users.

Must act: Anyone managing iPhones, iPads or Macs still on iOS/iPadOS 26 below 26.7.1, macOS Tahoe below 26.7.1 or macOS Sequoia below 15.8.1, most urgently devices used by executives, journalists, administrators and others likely to be singled out.

Can relax: Devices already on iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 or the 27.x releases, which the CVE record does not list as affected.

  1. Check every Mac with sw_vers -productVersion and every iPhone and iPad in MDM; anything below 26.7.1 (iOS, iPadOS, Tahoe) or 15.8.1 (Sequoia) needs the update.
  2. Install the update: softwareupdate --install --all --restart on Macs, Settings > General > Software Update on iPhone and iPad.
  3. Enforce a minimum OS version with a deadline in your MDM, and block corporate access from devices that miss it.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.