Apple Patches iMessage Group Chat Flaws Allowing Remote Attackers to Join Conversations
Apple has addressed a set of vulnerabilities that could have allowed remote attackers to join private iMessage group conversations and access message history.
The first issue, tracked as CVE-2026-113961, was caused by insufficient authorization validation. Apple strengthened the validation logic to prevent unauthorized participants from joining chats.
The second vulnerability, CVE-2026-113960, could have permitted a new participant to view messages sent before they joined the group. The company resolved it by removing the vulnerable code.
Both fixes are included in iOS and iPadOS 27.2.1 as well as the 26 branch updates version 26.7.3, released on 9 November.
Additional patches cover Bluetooth and AirPlay components. These include the ability to pair with a malicious Bluetooth device without user interaction and bypasses of pairing code attempt limits. Exploitation of these issues requires proximity within Bluetooth range or the same local network.
The updates also resolve a memory corruption flaw in the Brotli compression library that could be triggered by specially crafted data.
Related articles
Pentester Shares Experience Mistaking HTTP 500 Response for Remote Code Execution on Live React and Node.js Application
A security researcher published an account of their first real-world penetration test on a live website built with ReactJS and Node.js. On the fourth day of testing, the author encountered an HTTP 500 error that initially appeared consistent with a successful remote code execution attempt. The article describes the researcher's process of investigating the response and realizing the error was unrelated to code execution. The post highlights common pitfalls when interpreting server responses during active assessments. It also notes the use of standard web technologies and the researcher's intent to share lessons from the engagement. The publication is presented as a case study from the Habr platform.
Google Patches Eighth Chrome Zero-Day of 2026: CVE-2026-125350 Use-After-Free Exploited in the Wild
Google has released a new Chrome update that addresses a zero-day vulnerability already being exploited in real-world attacks. This marks the eighth such actively exploited 0-day fixed by the company since the beginning of 2026. The flaw, tracked as CVE-2026-125350, is a use-after-free error in the XML processing component that can lead to memory corruption and arbitrary code execution. An anonymous researcher reported the issue on November 6, and Google confirmed the existence of a working exploit without disclosing details about the attackers or targets. The update also resolves eight additional vulnerabilities across components including V8, WebGL, GPU, and the file system. Stable channel patches are now available for Windows, macOS, and Linux, with rollout expected to take several days to weeks.
Top 5 Cybersecurity Events of the Week: Barracuda Root Exploits, cPGuard Supply-Chain Attack, APT Flaw, Xen Escape Bugs, and OpenSSH Authentication Bypass
This week’s Jet CSIRT roundup highlights five critical security issues affecting widely deployed infrastructure. Two high-severity vulnerabilities in Barracuda Email Security Gateway and other appliances allow unauthenticated attackers to obtain root access via authorization bypass and command injection. A supply-chain compromise of cPGuard versions 5.88.12–5.88.19 enabled theft of password hashes, database files, and SSH keys from at least 32 customer servers before the malicious update was removed. A flaw in the APT package manager (CVE-2026-109518) lets network attackers substitute malicious packages that execute with root privileges on Debian and Ubuntu systems. Two Xen hypervisor bugs (CVE-2026-102703 and CVE-2026-102704) permit a compromised guest VM to read and write memory belonging to dom0 and other guests. Finally, an OpenSSH authentication bypass on musl-based Alpine Linux distributions allows passwordless login to key-only accounts when long password hashes trigger a crypt() return value of “*”.
CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers
CISA, the FBI, and multiple U.S. agencies issued a joint advisory on November 5 detailing malicious cyber activity targeting industrial refrigeration systems and cold chain monitoring equipment worldwide. Attackers are exploiting unpatched or internet-exposed temperature controllers in supermarkets and cold storage facilities through authentication bypass, arbitrary code injection, and weak configurations. Once inside the control panels, threat actors force units into continuous heating and defrost cycles, the opposite of their intended function, while also causing denial of visibility that prevents operators from seeing real equipment status. The advisory highlights risks including reduced system lifespan, fire hazards, stock loss, and potential consumer harm from spoiled products stored outside safe temperature ranges. Sectors most affected include public health, chemical manufacturing, food and agriculture, and refrigerated transportation. Recommended mitigations focus on network segmentation, removal of remote access from the public internet, strong authentication, firmware updates, and regular offline backups.