Apple Releases iOS 27 and iPadOS 27 with Fixes for 126 Vulnerabilities
Apple has released iOS 27 and iPadOS 27, addressing a total of 126 CVEs across multiple system components. The updates target issues in the kernel, WebKit, Bluetooth, video encoding, and media handling frameworks.
Twenty kernel vulnerabilities were resolved, including problems that could allow memory corruption or privilege escalation to root level. One example is CVE-2026-43689, which could permit a malicious app to obtain root privileges.
The WebKit browser engine received fixes for three vulnerabilities, while WebKit Canvas was updated for one additional issue. In the Bluetooth stack, CVE-2026-65414 was corrected; this flaw could allow remote attackers to crash apps or execute arbitrary code.
Three vulnerabilities were fixed in AVEVideoEncoder, the component responsible for video encoding. CoreMedia received patches for three issues, including flaws that could lead to arbitrary code execution when processing crafted images.
Apple also made iOS 26.7 and iPadOS 26.7 available for older devices that cannot upgrade to the latest major versions. All updates were published on September 14, 2026.
Related articles
BloodHound, smbmap and enum4linux-ng: Essential Tools for Starting Active Directory Penetration Testing
Active Directory remains the primary target in most internal penetration tests, regardless of how an attacker first gains network access. The article outlines a practical reconnaissance workflow that begins with identifying the domain name and domain controllers through port scanning for ports 88 and 389. Tools such as enum4linux-ng enable initial data collection without credentials by leveraging null sessions, while smbmap reveals readable and writable SMB shares that often contain SSH keys, certificates, and plaintext passwords. BloodHound, paired with collectors like SharpHound, maps relationships between users, groups, and computers to reveal attack paths toward Domain Admins. The piece stresses understanding Kerberos and NTLM protocols to apply techniques such as Kerberoasting, AS-REP Roasting, and pass-the-hash effectively rather than running commands blindly. It also covers quieter alternatives to noisy tools and provides a concise checklist for beginners, along with references to the Red September CyberED course on Active Directory attacks.
GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security released GitSpawn, detailing eight vulnerabilities across seven coding agents where opening a folder triggers arbitrary code execution via Git configuration before any user prompt. The core issue stems from the core.fsmonitor setting in .git/config, which Git executes during index updates like git status or git diff. While vendors including Anthropic patched Claude Code in version 2.1.196, the fix only blocks agent-initiated calls and leaves manual Git commands or other tools vulnerable. Additional vectors include nested bare repositories tracked under CVE-2026-45033 affecting GitHub Copilot CLI and unpatched agents such as Qwen Code and Grok Build. The researcher also released the Stroq tool to inspect repositories for dangerous settings like core.fsmonitor and postinstall scripts before opening them. The findings highlight that repository trust mechanisms from 2021 remain bypassed by modern AI coding tools.
Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
A critical vulnerability tracked as CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier, allowing unauthenticated attackers to upload arbitrary files including PHP web shells. The flaw resides in the wwlc_file_upload_handler AJAX action, where the file extension allowlist can be manipulated through the file_settings parameter to accept .php files. Exploitation has been observed in the wild with more than 100,000 blocked attempts since June 2026, including sustained campaigns from repeat IP addresses. The developer released version 2.0.3.2 on 20 February 2026 to address the issue, yet many sites remain unpatched. Organizations are advised to update immediately, audit wp-content/uploads for unexpected PHP files, and monitor admin-ajax.php requests for suspicious activity. In confirmed compromise cases, full remediation requires credential rotation and restoration from verified backups.
AWS Systems Manager Agent Flaw Allows Bypass of Port Forwarding Restrictions
Amazon has fixed a vulnerability in the AWS Systems Manager agent that permits an authenticated attacker to bypass restrictions on port forwarding sessions. The issue, tracked as CVE-2026-89049, stems from inadequate validation of equivalent representations of blocked link-local addresses. As a result, attackers can reach the EC2 instance metadata service at 169.254.169.254 and obtain temporary credentials tied to the instance's IAM role. Affected versions are those prior to 3.3.4851.0, with the fix included in that release and all subsequent versions. AWS recommends reviewing custom builds of the agent, restricting access to the AWS-StartPortForwardingSessionToRemoteHost document, auditing Session Manager activity, and applying least-privilege principles to IAM roles.