Apple ships 304 fixes, no new in-the-wild bugs
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Apple's October 2026 update patches 304 vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS and visionOS; no newly exploited flaws this cycle.
Apple released its October 2026 security updates covering iOS 27.2/26.7.2/18.7.11, iPadOS equivalents, macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2, addressing roughly 304 CVEs. SANS ISC notes the volume is consistent with Apple's typical monthly cadence, arriving about a month after the previous update. The only previously-exploited vulnerability referenced, CVE-2026-86950 (CoreGraphics), was originally patched a month ago for newer OS versions; this release simply backports the fix to iOS 18. No newly flagged actively-exploited vulnerability appears in this update.
Among the hundreds of fixes, defenders should prioritize patching kernel memory corruption and privilege-escalation issues (multiple 'gain root privileges' bugs in Security, StorageKit, SecurityAgent, CVMS, configd, and Crash Reporter), numerous WebKit arbitrary-code-execution flaws reachable via malicious web content, several sandbox-escape and Gatekeeper-bypass bugs (DesktopServices, LaunchServices, ArchiveService, BOM, System Settings), and remote-code-execution issues in Remote Management and Screen Sharing Server. Additional notable items include unauthorized camera access (CVE-2026-86990), Keychain item exposure to a local attacker (CVE-2026-28864), and a Kerberos KDC impersonation flaw in Heimdal (CVE-2026-112518).
For defenders, this is a routine but large monthly Apple patch cycle: no mass-exploitation or zero-day urgency is reported, but the breadth of kernel, WebKit, and privilege-escalation fixes warrants prompt deployment across managed Apple fleets, particularly for internet-facing Safari/WebKit components and devices still on older OS branches (iOS 18.x) that received the delayed CoreGraphics fix.
Mentioned in this report
Source reporting: https://isc.sans.edu/diary/rss/33458
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,256 reports from 143 sources, 599 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs