Apple patches actively exploited CoreGraphics zero-day
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
Apple fixed dozens of flaws across iOS, macOS, and WebKit, including CoreGraphics CVE-2026-86950, which is exploited in the wild and listed in CISA's KEV catalog.
MS-ISAC/CISA issued an advisory covering a large batch of Apple vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, patched in versions including iOS/iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, and macOS Sequoia 15.8.2. The most severe issues permit arbitrary code execution, in several cases with root, system, or kernel privileges, via maliciously crafted files, images, archives or web content processed by components such as CoreGraphics, WebKit, CoreMedia, ImageIO, Grapher, GPUTools, and the kernel. Additional flaws enable privilege escalation to root through Remote Management/Screen Sharing, CUPS, Security, StorageKit, configd, CVMS, Crash Reporter and CloudKit, as well as sandbox-escape and defense-evasion issues in App Store, WebKit Process Model, and dyld (pointer-authentication bypass).
Apple has confirmed that CVE-2026-86950 (a CoreGraphics arbitrary code execution flaw triggered by processing a maliciously crafted file) may have been exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on September 29, 2026. No other CVE in this batch is confirmed exploited. Given the breadth of affected platforms and active exploitation of at least one flaw, defenders should prioritize patching devices still on iOS/iPadOS 18 and systems used by high-risk individuals, apply least-privilege and anti-exploitation controls, and monitor for exploit attempts against Remote Management/Screen Sharing and web-content processing paths.
Mentioned in this report
Detection guidance
macOS Safari or WebKit Content Process Spawning Shell or Download Utility
Safari or the WebKit WebContent/GPU/Networking helper spawning a shell, scripting interpreter or download tool, which is a post-exploitation pattern after a WebKit or CoreGraphics client-side exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Safari or WebKit Content Process Spawning Shell or Download Utility
description: Detects Safari or WebKit helper processes (WebContent, GPU, Networking)
spawning a shell, scripting interpreter or download utility. Browser renderers do
not normally launch these, so this is a strong sign of code execution after exploitation
of a WebKit, CoreGraphics or ImageIO flaw from crafted web content.
tags:
- attack.execution
- attack.t1203
- attack.stealth
- attack.t1211
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|endswith:
- /com.apple.WebKit.WebContent
- /com.apple.WebKit.GPU
- /com.apple.WebKit.Networking
- /Safari.app/Contents/MacOS/Safari
selection_child:
Image|endswith:
- /sh
- /bash
- /zsh
- /osascript
- /curl
- /python3
- /perl
- /ruby
- /nscurl
condition: selection_parent and selection_child
falsepositives:
- Web developers running local tooling through Safari extensions or debugging helpers
- Security testing of browser exploit chains in lab environments
level: high
id: 3cf4f2ea-ae88-57f6-8e87-0341fa9fd806
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121
macOS Image or Document Rendering Process Spawning Shell
Preview, Quick Look or thumbnail-generation processes launching a shell, osascript or download tool, which is consistent with exploitation of a crafted image or file parsed by CoreGraphics or ImageIO. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Image or Document Rendering Process Spawning Shell
description: Detects Preview, Quick Look and thumbnail-agent processes spawning a
shell, osascript or a download utility. These processes parse untrusted files through
CoreGraphics and ImageIO, and a child interpreter suggests exploitation of a crafted
file for code execution.
tags:
- attack.execution
- attack.t1203
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|endswith:
- /Preview.app/Contents/MacOS/Preview
- /quicklookd
- /QuickLookUIService
- /com.apple.quicklook.ThumbnailsAgent
- /QuickLookSatellite
selection_child:
Image|endswith:
- /sh
- /bash
- /zsh
- /osascript
- /curl
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- Third-party Quick Look plugins that shell out to helper scripts to render previews
level: medium
id: f0f54679-fc7d-5920-a0f4-16d91a0473b5
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,359 reports from 144 sources, 627 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs