Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Apple issues iOS 27.0 release candidate (build 24A437); notification lists no security fixes or CVEs.
Apple published the iOS 27.0 Release Candidate, build 24A437, on its developer release feed. The notice provides only download and release-notes links without vulnerability or CVE details. Security teams should monitor the accompanying release notes for security fixes ahead of general availability.
Apple seeded iOS 27.0 release candidate build 24A435 to developers ahead of the general release.
Apple released the iOS 27.0 release candidate (build 24A435) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
Apple released iOS 26.6.2 (build 23G90), a minor software update listed on its developer releases page without vulnerability details.
Apple released iOS 26.6.2, build 23G90, listed on its developer software releases page dated September 8, 2026. The available page content only provides download links, with no published vulnerability details, CVEs, or change notes in the source text.
Apple released iOS 18.7.10 (build 22H374), a maintenance update delivering security fixes for iPhones on the iOS 18 line.
Apple published the iOS 18.7.10 release (build 22H374) on August 17, 2026 via its software releases feed. The listing provides download links and release notes but includes no CVE details in the announcement text. Point releases on the legacy iOS 18 branch typically carry security and stability patches for devices not yet on iOS 26.
An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.
The company moved from periodic penetration testing to continuous exposure management using the NodeZero Proactive Security Platform, feeding telemetry into a Splunk-based CTEM pipeline via Horizon3 APIs. NodeZero exposed SSH RSA key pairs from a PHP web server change about eight hours after introduction and found more findings in 12 hours than a third-party engagement found in roughly 30 days. An Active Directory password audit of 15,000 passwords found about 300 identical or similar compromised passwords, driving a banned-password list, 12-character minimums, service desk changes, and self-service reset rollout; users with similar passwords later dropped from 880 to 209. NodeZero also validated a suspected Cisco vulnerability as exploitable.
Apple released the Xcode 27 release candidate (build 27A266a) via its developer releases page.
Apple has published a release candidate of Xcode 27, build 27A266a, on its developer releases page. The listing contains no security notes, CVEs, or vulnerability details in the available text. This is a routine vendor software release ahead of the final Xcode 27 version.
Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.
Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.
Cisco released IOS XR security hardening fixes for multiple internally discovered vulnerabilities, grouped by CWE class, with no known active exploitation.
Cisco's IOS XR engineering team conducted a comprehensive internal security review and released hardening updates addressing multiple internally discovered vulnerabilities. The issues were found during internal testing and are not known to be actively exploited. Cisco grouped the vulnerabilities by CWE class and assigned a single CVE ID to each grouping to streamline patching and disclosure.
Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0, found internally with no exploitation observed.
Cisco released fixes for four Crosswork platform vulnerabilities including CVE-2026-20030 SQL injection and CVE-2026-20357 missing authentication, both scoring CVSS 10.0, affecting Crosswork Release 7.2.1 and earlier. Five additional flaws in Secure Workload, including CVE-2026-20315 and CVE-2026-20317 at CVSS 10.0, affect SaaS and on-premises deployments up to releases 3.10 and 4.0. All issues were found through internal testing and are not known to be actively exploited. The patches follow a broader internal security review that recently addressed 12 Catalyst SD-WAN and IOS XE bugs.
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
Apple released Xcode 27 (build 27A266a) with no security fixes detailed in the announcement.
Apple published Xcode 27 (27A266a) on its developer news feed. The notice contains only download and release-note links. No security content is described in the announcement itself.
Apple released iOS 26.6.1 (build 23G83), a point update with security fixes for iPhones running iOS 26.
Apple published iOS 26.6.1 (build 23G83) on August 17, 2026 through its software releases page. The feed entry provides downloads and release notes only, without enumerating fixed CVEs or noting any active exploitation. Such rapid point releases typically address security vulnerabilities and stability regressions in iOS 26.
Cisco patched three critical flaws, including CVE-2026-20212 unauthenticated remote root code execution in Nexus 9000 switches; no exploitation observed yet.
Cisco disclosed three critical-rated flaws found during a comprehensive internal security review. CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, affect the IOS XR carrier-grade operating system and are fixed in newly released versions. CVE-2026-20212 lets unauthenticated remote attackers execute code with root privileges on some Nexus 9000 Series Switches by reaching TCP ports 43210 and 43211 in the default Layer 3 VRF; no software fix exists yet, only infrastructure ACL mitigations. Cisco says it has not observed attacks against these flaws.
Apple seeded iOS 27.0 beta 8 (build 24A5430a) to developers with no security fixes disclosed in the release listing.
Apple released iOS 27.0 beta 8, build 24A5430a, through its developer program on August 31, 2026. The build number matches the same-cycle iPadOS 27.0 beta 8, indicating shared platform code. No vulnerability information or CVEs are disclosed in the release listing.
Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.
Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.
Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.
Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.
Apple seeded iPadOS 27.0 beta 8 (build 24A5430a) to developers, sharing its build number with the same-cycle iOS 27.0 beta 8.
Apple released iPadOS 27.0 beta 8, build 24A5430a, to developers on August 31, 2026. The build number matches the same-cycle iOS 27.0 beta 8, indicating shared platform code across iPhone and iPad. No security fixes or CVEs are disclosed in the release listing.
Apple released iPadOS 26.6.1 (build 23G83), a maintenance update applying security fixes to iPads on the iPadOS 26 line.
Apple listed iPadOS 26.6.1 (build 23G83) on August 17, 2026. The release entry contains only download links and release notes, with no CVE identifiers or exploitation details in the announcement. The matching build number with iOS 26.6.1 indicates shared core components updated in tandem across Apple platforms.
Apple released iPadOS 18.7.10 (build 22H374), a maintenance update with security fixes for iPads remaining on the iPadOS 18 branch.
Apple listed iPadOS 18.7.10 (build 22H374) on August 17, 2026. The announcement provides only download links and release notes, with no CVE details or exploitation notes included. The shared build number with iOS 18.7.10 indicates the same legacy-branch security maintenance for older devices not running iPadOS 26.
Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.
Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.
Hacker News discussion argues Apple Intelligence is a marketing umbrella for disparate long-standing ML features, explaining why iOS 27 lacks a disable switch.
A 'Tell HN' post reports that iOS 27 does not allow users to fully disable Apple Intelligence. Discussion replies argue 'Apple Intelligence' is a marketing term covering disparate features rather than a single product. Commenters cite long-standing local-model features such as image OCR, battery-life prediction, and the Latent Semantic Mapping text classification framework available since 2007.
Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.
Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.
Canada's Cyber Centre relays HPE advisories covering multiple vulnerabilities in Aruba AOS-CX switches and Fabric Composer, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-873 noting multiple vulnerabilities in HPE Aruba Networking AOS-CX and Fabric Composer. Affected versions span AOS-CX releases through branches 10.10, 10.13, 10.16, 10.17, and 10.18, and Fabric Composer through 7.3.3. Administrators are urged to review HPE bulletins HPESBNW05133 and HPESBNW05134 and apply available updates.
Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.
The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.
Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.
SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.
Apple released an update to TestFlight, its beta app testing platform, with release notes published on the developer portal.
Apple published a software release notice for TestFlight, the company's beta testing platform for iOS, iPadOS, and other Apple platforms. The release notes are available through Apple's developer releases page. No security content or vulnerability details are provided in the notice.
Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.
The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.