Apple Patches 163 Vulnerabilities in iOS 27.2 Including Multiple WebKit Code Execution Flaws
Apple released iOS 27.2 and iPadOS 27.2 on October 26, fixing a total of 163 vulnerabilities. More than 30 of these issues affect WebKit, the rendering engine used by Safari and any application that displays web content on iPhone and iPad.
Several WebKit flaws allow arbitrary code execution when a user opens a specially crafted webpage. Among the code execution vulnerabilities are four use-after-free issues, including CVE-2026-112697 and CVE-2026-112623, as well as a type confusion vulnerability registered as CVE-2026-112659. Three additional issues impact the Canvas API, JavaScript bindings, and the browser's process model.
The update also contains two sandbox escape vulnerabilities. One resides in the WebKit process model and was resolved by removing the vulnerable code. The second affects the App Store and was reported by researchers from Cisco Talos.
Approximately 15 fixes address the kernel. Four entries relate to privacy. CVE-2026-86987 in Apple Intelligence allowed a remote attacker to access sensitive user data. CVE-2026-112500 exposed the real email address of users relying on Hide My Email, while two other flaws permitted an app to list installed applications and activate the camera without authorization.
Apple did not record any in-the-wild exploitation of the 163 vulnerabilities. On the same day the company issued iOS 18.7.11 for older devices including the iPhone XS and iPhone XR, addressing CVE-2026-86950 in CoreGraphics. The company confirmed that this out-of-bounds write vulnerability, which can lead to code execution via a crafted file, had been exploited in an extremely sophisticated attack targeting specific individuals. The flaw was reported by Meta's product security team and had already been fixed in September for newer devices in iOS 26.7.1.
The iOS 27.2 update is available for iPhone 11 and later models. Users who have not yet upgraded to version 27 received iOS 26.7.2 on the same day. The update can be installed via Settings > General > Software Update.
Related articles
PHP Patched Against PHP2Shell: Save php -v Output as Potential Court Evidence
Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, affecting the PHP core interpreter across all versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The flaws, collectively called PHP2Shell, carry a CVSS 4.0 score of 9.2 and allow unauthenticated attackers to execute arbitrary code on servers running WordPress, 1C-Bitrix, Drupal, OpenCart, Laravel, and other frameworks. Official patches have been released, yet organizations must also restart PHP-FPM, web servers, and queue workers to fully eliminate the vulnerable code from memory. Russian regulators may impose fines up to 15 million rubles for personal data leaks stemming from unpatched instances, and courts will examine documentation proving when and how the vulnerabilities were addressed. Security teams are advised to preserve command outputs from php -v and php-fpm -v along with timestamps and responsible-party records. If signs of compromise are detected, logs must be retained before any remediation steps are taken, and notifications to Roskomnadzor must be filed within 24 hours of confirmed data exposure.
Black October Hype: Media Inflates AI Agent Role in PHP, GitLab and Cloud Platform Incidents
A detailed analysis reveals that recent high-profile cybersecurity stories have been sensationalized by attributing autonomous AI agent swarms to standard vulnerability disclosures and human-operated attacks. Critical PHP zero-day flaws enabling remote code execution were responsibly researched with GPT-5.6 Sol under OpenAI's Patch the Planet program, not by rogue AI bots launching millions of scans. The Argentina hospital compromises involved human operators using Anthropic's Claude Code CLI tool in a Human-in-the-Loop workflow rather than uncontrolled AI rebellion. Breaches at Zeabur, Railway and OpenCode stemmed from poor secret management and forgotten consoles, allowing credential theft for API abuse. A decade-old integer overflow in GitLab's Onigmo regex engine received a CVSS 10.0 score but had no connection to AI. The piece argues that adding AI narratives boosts clicks while obscuring classic attack patterns such as masscan-driven scanning after public PoC leaks.
Fuzzilli vs BigSleep: 37 and 45 Vulnerabilities Found in V8 Over Six Months with 25% Overlap
Google's Project Zero compared two automated vulnerability discovery tools targeting the V8 JavaScript engine in Chrome. The generative fuzzer Fuzzilli identified 37 actionable vulnerabilities over six months, while the LLM-based agent BigSleep found 45. Only about 25% of the vulnerabilities overlapped between the two systems. Additional experiments on historical bugs from 2023 onward showed a theoretical overlap of around 60%. The analysis indicates that fuzzing and LLM agents complement each other rather than one replacing the other. Researchers recommend using both approaches together to maximize coverage of complex bugs in well-tested software like V8.
ISPsystem Publishes Detailed Timeline of VMmanager 6 Attack and Vulnerability Analysis
ISPsystem has released a comprehensive post detailing a recent security incident targeting its VMmanager 6 virtualization management platform. The company outlines the chronology of the attack, the specific vulnerabilities exploited by threat actors, and the current mitigation status. The incident has sparked significant discussion within the professional hosting and virtualization community. ISPsystem emphasizes transparency and provides technical breakdowns to help users understand the attack vectors and required defensive measures. The post covers how the attackers gained initial access and the subsequent impact on managed virtual environments.