CYBER THREATCAST

Upgrade Apple iOS to 26.7.1 or later immediately. Apple has patched CVE-2026-86950, an actively exploited CoreGraphics zero-day in versions before 26.7.1; a maliciously crafted file can trigger an out-of-bounds write and potentially arbitrary code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a three-day federal remediation requirement.

Patch exposed Citrix NetScaler ADC and NetScaler Gateway appliances now, then hunt for the identified files, configuration entries, and permission changes. Opportunistic attackers are attempting administrator access, deploying web shells, deleting logs, restarting appliances, and modifying system and web-server configuration to conceal malicious traffic. The affected vulnerabilities carry CVSS scores of 9.5 and can enable remote code execution.

Apply Cisco’s corrected versions or patches for Identity Services Engine CVE-2026-76460 without delay. Cisco has observed exploitation of the vulnerability, making rapid remediation necessary for organizations operating the affected identity platform.

Revoke lingering Limit Break Payment Processor V2 contract approvals immediately. Attackers exploited sender spoofing and persistent approve-for-all permissions tied to the deprecated contract to steal approximately $2.8 million in NFTs and cryptocurrency. Magic Eden users with old approvals remain exposed until those permissions are revoked.

Upgrade SolarWinds Observability Self-Hosted to version 2026.2.3. The release fixes CVE-2026-28324, a critical unauthenticated remote-code-execution flaw rated CVSS 9.8, and CVE-2026-28325, an untrusted-deserialization vulnerability rated CVSS 8.8. No public proof of concept or known exploitation was reported, but the unauthenticated attack path warrants prompt remediation.