Threat Digest — October 27, 2026: Apple Zero-Day, Breaches

Top Stories#

• Apple backported patches for a CoreGraphics zero-day to older iPhone and iPad models. The flaw was exploited in targeted attacks against iOS devices. Verify through mobile-device-management reporting that legacy Apple devices received the update. BleepingComputer

• ENGIE disclosed a customer data breach after attackers compromised a marketing platform used by business partners. The incident puts third-party marketing systems, partner access, and data-sharing arrangements under scrutiny. BleepingComputer

• The University of Copenhagen reported unauthorized access to a test environment containing personal data associated with approximately 525,000 people. Test systems need the same access controls, monitoring, and data-minimization requirements as production environments. BleepingComputer

• A South Korean cybercrime operation allegedly used the ARTEX AI penetration-testing framework to compromise more than 90 organizations and steal 8.2 million records. Monitor for abuse of legitimate security and automation tools, particularly unusual bulk discovery and data transfers. BleepingComputer

• DreamHost forced email, FTP, and SFTP password resets during an ongoing security incident that affected File Manager connectivity. Reset credentials, review authentication activity, and avoid password reuse across hosting and administrative accounts. BleepingComputer

Analyst’s Take: The clearest first move is to address the CISA KEV entries and the exploited Apple flaw, then verify the changes through asset and MDM reporting. The breach reports point to a second track: review third-party access, test environments, and hosting credentials rather than treating patching as the complete response.

For background, see our CVE glossary and guidance on secrets management.

Critical Vulnerabilities#

CISA Adds Two PHP Vulnerabilities to KEV

CISA added CVE-2026-109618, a PHP memory-corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, to the Known Exploited Vulnerabilities catalog. Federal agencies were directed to remediate the issues, and other organizations should treat the entries as an urgent prioritization signal. CISA

Identify PHP runtimes and applications exposed to the internet, confirm exact versions, apply available fixes, and review logs for exploitation attempts. Prioritize systems that process untrusted requests or host sensitive applications.

Brotli HTTP2Shell Vulnerability

A critical vulnerability in the Brotli C decoder library can cause memory corruption and potentially expose sensitive data in affected Node.js deployments. Apply available vendor updates and restart dependent services after patching. BleepingComputer

Review Node.js inventory, container images, lockfiles, and transitive dependencies. A direct application upgrade may not be sufficient if Brotli is bundled into a runtime or operating-system package.

Rust zip Path-Write Risk

CVE-2026-115905 affects the Rust zip library through version 9.0.4. Inconsistent handling of duplicate ZIP filename metadata can allow a crafted archive to appear benign to one component while a streaming extractor writes attacker-selected paths or content.

Upgrade to 9.0.5. The advisory and release details are available from the zip-rs security advisory and 9.0.5 release.

Fortinet FortiSandbox Authentication Bypass

CVE-2026-107656 is a critical authentication bypass affecting Fortinet FortiSandbox versions 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9. Fortinet lists fixes in 5.0.7 and 4.4.10 or later. Fortinet advisory

Restrict management interfaces, review administrative access logs, and investigate unexpected commands or configuration changes before and after upgrading.

Mautic Arbitrary File Upload

CVE-2026-115188 affects Mautic 7 and allows an authenticated user with campaign-import permission to upload arbitrary files, including server-side scripts. This can lead to remote code execution depending on deployment configuration.

Upgrade Mautic and reduce campaign-import permissions to the minimum required users. Review web-server logs for unexpected uploads and execution attempts. Mautic advisory

Burrito Unsigned Webhooks

CVE-2026-102649 affects Burrito versions before 0.13.0 when GitHub or GitLab webhook secrets are absent or empty. Attackers who can reach the burrito-server endpoint may forge events and trigger unauthorized Terraform plans using stored credentials.

Upgrade to 0.13.0, require nonempty webhook secrets, restrict endpoint exposure, and review recent Terraform plans and provider activity. Burrito advisory

NexoPOS Directory Traversal

CVE-2026-107092 affects NexoPOS 6.2.4 and earlier through directory traversal in the api/update endpoint. Upgrade to 6.3.0 or apply the temporary 6.2.5 security patch. NexoPOS advisory

Review web logs for encoded traversal sequences, unexpected file access, and requests to the affected endpoint. Isolate systems that cannot be patched promptly.

What Defenders Should Do Today#

1. Prioritize the CISA KEV entries. Find CVE-2026-109618 and CVE-2026-109619 across PHP environments, patch urgently, and validate that internet-facing services are no longer exposed.

2. Deploy Apple’s backported CoreGraphics updates. Confirm installation on older iPhones and iPads through MDM reporting. Remove unsupported devices from sensitive workflows if updates cannot be installed.

3. Patch the critical software listed in this digest. Update Brotli-dependent Node.js deployments, Rust zip, FortiSandbox, Mautic, Burrito, and NexoPOS. Temporarily isolate systems that cannot be updated.

4. Audit archive-processing pipelines. Review ZIP extraction logic for path traversal, duplicate-filename handling, absolute paths, symlinks, and extraction outside the intended directory.

5. Rotate hosting credentials. Reset DreamHost email, FTP, and SFTP passwords, inspect authentication logs, enforce unique credentials, and enable multifactor authentication where available.

6. Review third-party data access. Audit marketing platforms, partner integrations, test environments, and cloud storage for excessive permissions, exposed personal data, and suspicious downloads.

7. Monitor for tool abuse. Hunt for unusual use of legitimate penetration-testing, AI, discovery, and automation tools, especially high-volume authentication, enumeration, and data-transfer activity.

8. Preserve evidence and meet notification obligations. Retain relevant logs, identify affected data, document containment and remediation, and notify stakeholders according to applicable breach requirements.

Technical Notes#

Identify Vulnerable PHP and Application Assets

Use software inventory, package-management data, and authenticated vulnerability scanning to locate affected PHP runtimes and applications:

# Example: inspect PHP runtime versions on Linux
php -v

# Example: list installed Debian PHP packages
dpkg-query -W -f='${Package}\t${Version}\n' 2>/dev/null | grep -i '^php'

# Example: list installed RPM PHP packages
rpm -qa 2>/dev/null | grep -i '^php'

Do not rely solely on the runtime version. PHP applications, bundled libraries, containers, and reverse proxies may expose separate vulnerable components.

Hunt for Suspicious ZIP Extraction

Search application logs for archive-processing activity and traversal indicators. Patterns vary by web server and application:

grep -RaiE '(\.\./|%2e%2e|%252e|zip|extract|unpack)' \\
  /var/log/nginx /var/log/apache2 2>/dev/null

A safer extraction workflow should reject absolute paths, normalize paths before writing, and verify that every destination remains under the intended extraction directory:

from pathlib import Path
from zipfile import ZipFile

def safe_extract(archive_path: str, destination: str) -> None:
    root = Path(destination).resolve()

    with ZipFile(archive_path) as archive:
        for member in archive.infolist():
            target = (root / member.filename).resolve()

            if target != root and root not in target.parents:
                raise ValueError(f"Blocked archive path: {member.filename}")

        archive.extractall(root)

Applications should also define how duplicate filenames are handled and should scan archives before extraction.

Validate Webhook Security

Burrito deployments should require a nonempty secret and restrict webhook endpoints to expected source networks where possible:

webhooks:
  require_secret: true
  secret: "${WEBHOOK_SECRET}"
  allowed_sources:
    - "trusted-ci-network"

The exact configuration key names depend on the deployed version and integration. Confirm the supported settings in the product documentation before applying changes.

Review Authentication and File-Transfer Activity

For DreamHost or other hosting environments, review provider logs for:

• Successful and failed email, FTP, and SFTP logins
• New source IP addresses or geographic anomalies
• Password-reset and account-recovery events
• Newly created mail-forwarding rules
• Bulk downloads or uploads
• Changes to web roots, cron jobs, SSH keys, or administrative users

Example local searches for common Linux authentication records:

grep -Ei 'sshd|sftp|ftp|authentication failure|accepted password|reset' \\
  /var/log/auth.log /var/log/secure 2>/dev/null

Sources

• Apple backports CoreGraphics zero-day patches to older iPhones
• ENGIE discloses data breach affecting customers
• CISA confirms PHP2Shell vulnerabilities are exploited
• University of Copenhagen data breach
• ARTEX AI cybercrime operation
• DreamHost password resets
• HTTP2Shell Brotli vulnerability
• CISA KEV catalog update

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.