iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple on Monday released updates for its operating systems, addressing a total of 286 vulnerabilities across the newest versions of iOS and macOS. In addition, the company has backported the fix for an exploited vulnerability to iOS 18.

macOS Golden Gate 27.2 resolves 263 vulnerabilities while iOS and iPadOS 27.2 fix 163 flaws. Roughly 140 of the security holes are shared across the two operating systems.

The iOS and iPadOS 27.2 updates address many memory corruption bugs in WebKit, the kernel and components that handle images, fonts, PDFs, audio and video files, some of which could be exploited for arbitrary code execution.

Apple also resolved flaws that could let apps access sensitive user data or bypass privacy preferences, along with WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give a nearby attacker access to a Thread network.

macOS Golden Gate 27.2 patches more than a dozen privilege escalation flaws that could give apps root access, as well as sandbox escapes, Gatekeeper bypasses and kernel memory corruption issues in file system and disk image components.

The update also fixes numerous security holes in Screen Sharing, Remote Management and SMB that can be targeted remotely or from the local network, including a Remote Management bug that could allow a remote attacker to execute arbitrary code.

iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, which had been exploited as a zero-day in what Apple described as an “extremely sophisticated attack.”

The vulnerability, discovered by Meta’s product security team, was first patched by Apple in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. iOS and macOS 27 do not appear to be affected.

There does not appear to be any public information detailing the attacks exploiting CVE-2026-86950.

Apple on Monday also released iOS and iPadOS 26.7.2, which fix 134 vulnerabilities, macOS Tahoe 26.7.2, which patches 213 vulnerabilities, and macOS Sequoia 15.8.2, with 197 flaws patched.

The tech giant also released tvOS 27.2 (72 vulnerabilities patched), watchOS 27.2 (62 vulnerabilities), visionOS 27.2 (125 vulnerabilities), and Safari 27.2 (33 vulnerabilities).

Related : Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks

Related : Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Related : AI Slop Limits Apple Bounties

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.

PHP2Shell Exploitation Moves From Probes to Working Shells

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

Attackers Exploit Third Arista VCO Zero-Day in Four Months

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

Splunk, SolarWinds Release Fresh Security Updates

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.