Apple iPadOS

CVE-2026-111497, Brotli decoder flaw in Siemens industrial and software products (Desigo CC, SIMATIC WinCC, Industrial Edge, Teamcenter and Opcenter among them), Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while most Siemens products, the Mitel updates and the Industrial Edge Common Configurator fix are still pending

The Brotli decoder flaw CVE-2026-111497 is an out-of-bounds write caused by improper handling of malformed compressed data (Mitel, 2026-10-28), and CISA lists it as exploited (CISA, 2026-10-27). Siemens' advisory SSA-045512, revised on 2026-11-06, lists Desigo CC V8 and V9, all versions, remedied by installing the latest .NET security updates via Windows Update, Gridscale X DSA from V5.3 below V5.4 (fixed in V5.4) and Gridscale X PSS®E below V36.8.0 (fixed in V36.8.0), and scores the flaw CVSS 3.1 9.8 (Siemens ProductCERT, 2026-10-30). Its Industrial Edge advisory SSA-443410 gives fixed versions for six configurator and monitoring applications, and for Common Configurator, which has no fix, says to uninstall all Management Applications and use a firewall or WAF, or stop the application on a device (Siemens ProductCERT, 2026-10-30). Two further Siemens advisories of 2026-11-10, both interim, list 15 industrial and 28 software products, with a fix only for WinCC OA V3.20 and BRAUMAT and SISTAR and mitigations that differ by product, some products having none; neither says anything about exploitation (Siemens ProductCERT, 2026-11-10) (Siemens ProductCERT, 2026-11-10).

Mitel's MISA-2026-0010, revision 5.0 of 2026-11-04, rates the flaw high (CVSS 3.1 8.1) and lists MiVoice Business and five OpenScape products, up to the versions in its table, as affected; for each an update is planned, not released, and workaround articles exist for OpenScape SBC, SESAP and Contact Center (Mitel, 2026-10-28).

Cisco's advisory, version 1.12 of 2026-11-12, says its PSIRT is aware that proof-of-concept exploit code is available and is not aware of any malicious use against any Cisco product; it lists Catalyst SD-WAN, Identity Services Engine, IOS XE, IOS XR and Secure Firewall ASA, FMC and FTD as not impacted (Cisco PSIRT, 2026-10-27). Its single fix table lists Duo Network Gateway (3.4.2), Spaces (24.22.1), RoomOS on Board, Desk and Room Series devices (on-premises 11.41.2.3 and 26.7.4.3) and a longer list whose fixes are dated November 2026 to March 2027 (Cisco PSIRT, 2026-10-27).

Builds on: Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0… · Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows…

Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-04

CISA added CVE-2024-27834, a WebKit flaw that lets an attacker with arbitrary read and write capability bypass Pointer Authentication and that Apple fixed on 2024-05-13, to its Known Exploited Vulnerabilities catalog on 2026-11-04, and names no victim or method (CISA KEV, 2026-11-04; Apple, 2024-05-13; Apple, 2024-05-13). The same day Sekoia reported a watering-hole campaign that it assesses with moderate to high confidence to be APT29 or one of its subgroups and in which that flaw is the pointer-authentication bypass of an iOS chain (Sekoia, 2026-11-04); the link between the listing and the campaign is the date alone. Sekoia retrieved three chains from the delivery host, which profiles the visitor and serves a platform-specific exploit without user interaction: an iOS 16.7 chain (CVE-2025-43529, then CVE-2024-27834) that steals the cookies of running apps; a DarkSword-based iOS chain that Sekoia's table labels iOS 18.5 (CVE-2025-43529 with CVE-2026-20700, then CVE-2025-14174 with CVE-2025-43510, then CVE-2025-43520) that harvests the phone; and an Android chain for Chrome 139 to 145 except 143 (CVE-2026-3910, then the Adreno driver flaw CVE-2025-27038) that takes Chrome cookies, saved logins, history and Wi-Fi configuration (Sekoia, 2026-11-04). The payloads exfiltrate data without establishing persistence, and Sekoia says none of the chains contains a zero-day or works against fully updated devices (Sekoia, 2026-11-04).

Delivery used JavaScript injected into legitimate sites, among them a Ukrainian gas producer, a US chemical-industry trade association, a Bulgarian military-related site and an Australian clinic; reverse-proxy clones of high-profile sites; and a one-week compromise, 27 August to 3 September 2026, of the Plerdy SEO tracker script, which Sekoia says exposed hundreds or thousands of sites, mostly Ukrainian (Sekoia, 2026-11-04). Sekoia names no Swiss victim, counts no infected devices and says it is working with national CERTs on victim identification.

Fixes: iOS 26.2 and 18.7.3 close CVE-2025-43529 and CVE-2025-14174, iOS 26.1 and 18.7.2 close CVE-2025-43510 and CVE-2025-43520, iOS 26.3 closes CVE-2026-20700, and Chrome 146 closes CVE-2026-3910 (Apple, 2025-12-12; Google Threat Intelligence Group, 2026-03-18; Chrome Releases, 2026-03-12).

Builds on: DeadTag: expired tag domains send visitors to iPhone exploit kits; opening the page is enough…

CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the graphics component shared by iOS, iPadOS and macOS, and processing a maliciously crafted file can lead to arbitrary code execution (Apple, 2026-09-28). Apple states that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" (Apple, 2026-09-28). The fix, "improved bounds checking", ships in iOS and iPadOS 26.7.1 (Apple, 2026-09-28), in iOS and iPadOS 18.7.11 for iPhone XS, XS Max, XR and iPad 7th generation (Apple, 2026-10-26), macOS Tahoe 26.7.1 (Apple, 2026-09-28) and macOS Sequoia 15.8.1 (Apple, 2026-09-28); Meta Product Security is credited with the report. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-29 (CISA, 2026-09-29). ENISA's vulnerability database scores it CVSS 3.1 8.8, network vector with user interaction required (ENISA EUVD, 2026-09-29). The macOS advisories repeat Apple's iOS-scoped exploitation sentence, so Apple does not claim exploitation on macOS.

Nothing about the attack itself is public: Apple gave no details on how many people were targeted, whether any attempt succeeded, or when exploitation began (The Hacker News, 2026-09-29), and no delivery mechanism is stated. SecurityWeek reads the component's role in 2D graphics and PDF rendering as meaning a file could arrive through web pages, email attachments or messaging apps, where automatic previews could allow zero-click exploitation; that is SecurityWeek's inference, and it also notes Meta would not say whether WhatsApp was involved (SecurityWeek, 2026-09-29). It also says iOS 27 and macOS Golden Gate 27 do not appear to be affected. No indicators or behavioural detections have been published by Apple, Meta or CISA, so version compliance is the only measurable lever: device-management inventory of iPhones and iPads below iOS or iPadOS 26.7.1 (below 18.7.11 on iPhone XS, XS Max, XR and iPad 7th generation), and of Macs on Tahoe or Sequoia below the fixed builds.