Apple patches 329 flaws, including silent camera access

Apple fixes 329 vulnerabilities, including a camera-access flaw

Apple released updates addressing 329 unique vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS, visionOS and Safari, one of its largest security releases in recent memory. CVE-2026-86990, a CoreMedia flaw, could let a malicious app access the camera without permission on iPhone, iPad, Mac and Apple Vision Pro. CVE-2026-86987 affects Apple Intelligence and could expose sensitive user information to a remote attacker. Apple also patched WebKit flaws that could allow malicious web content to execute code, plus a Siri issue in macOS. The October 26 releases cover three iOS generations, down to the iPhone XS, and extend a CoreGraphics fix (CVE-2026-86950) previously linked to a highly targeted attack. Apple credits AI-assisted research tools including Claude and Codex.

Apple Just Patched 329 Security Flaws Across iPhone, Mac, and iPad, Including One That Let Apps Secretly Access Your Camera →

Topics: ApplePatch Tuesday & security updates

CISA adds exploited PHP2Shell flaws to KEV Catalog

CISA added two critical PHP vulnerabilities tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities Catalog, ordering Federal Civilian Executive Branch agencies to secure systems by Thursday under Binding Operational Directive 26-04. The PHP security team patched both flaws on October 21, a day after urging fast updates. Details and CVE IDs leaked before patches shipped, and some proof-of-concept exploits were published, though the PHP team said none were functional. Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack logged widespread but unsuccessful exploitation attempts before disclosure; Amazon said attackers began targeting the flaws four days before patches. PHP powers roughly 70% of websites.

CISA confirms PHP2Shell vulnerabilities now exploited in attacks →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

The Gentlemen ransomware claims 800-plus victims

The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, previously an affiliate of LockBit and Qilin as ArmCorp or Phantom Mantis, and began deploying its own ransomware in July and August 2025. Affiliates keep up to 90% of ransom revenue, and the group claims more than 800 victims, mostly in the United States and Europe, with manufacturing, technology, health care, professional services and retail most targeted. Its Go-based ransomware hits Windows, Linux, NAS and BSD systems with double extortion and the .cyvzca extension, disables Windows Defender, clears event logs, deletes shadow copies and spreads via PsExec. A May 2026 internal breach exposed negotiations and affiliate data, linking its leadership to Qilin.

The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation →

Topics: Ransomware

Aokigahara infostealer targets AI assistants and developer keys

Check Point researchers discovered a Windows infostealer dubbed Aokigahara that steals browser passwords, session cookies, cryptocurrency wallets, VPN and FTP credentials, and hunts local files for authentication tokens and API keys. It specifically targets AI-driven assets, collecting authentication files, session data and configuration files tied to Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI, plus Git access data, SSH private keys and AWS, Azure and Google Cloud credentials. Check Point says the targeting reflects a shift in what attackers value: access to AI services and the environments developers build software in. The malware checks for virtual machines and sandboxes, then zips and encrypts stolen data before exfiltration.

‘Aokigahara’ Stealer Targets ‘Developer Keyrings’ & AI Assistants →

Topics: Malware & infostealers

Three labs confirm Pegasus on Serbia’s rector before election

Citizen Lab, Amnesty International’s Security Lab and the SHARE Foundation confirmed that Serbia’s intelligence apparatus deployed NSO Group’s Pegasus, Cellebrite extraction hardware and a custom Android implant against at least 15 people during the 2026 election cycle, including University of Belgrade rector Vladan Đokić and a senior anti-corruption prosecutor. The disclosures came a day after Aleksandar Vučić conceded defeat in the October 25 parliamentary election. Đokić’s iPhone was compromised via a zero-click exploit, confirmed with high confidence. Amnesty traced NoviSpy command-and-control traffic to BIA infrastructure and documented Cellebrite use during interrogations. The BIA dismissed the allegations; no official investigation has opened, and 29 MEPs and seven US senators have pressed for accountability.

Three Labs Confirm Serbia Hacked Rector and Prosecutor With Pegasus Before Vote →

Topics: Spyware