Mobil va simsiz
iOS, macOS 27.2 286 ta xatolikni tuzatdi; Foydalanilgan zaiflik tuzatmasi iOS 18 ga qayta qo'llandi
Apple iOS va macOS 27.2 da jami 286 ta zaiflikni tuzatdi va eski iPhone'lar uchun ishlatilgan CoreGraphics nol-kun zaifligi tuzatmasini qayta qo'lladi.
Muallif
Eduard Kovacs
| 27-oktabr, 2026 (ET 7:49)
Apple dushanba kuni operatsion tizimlari uchun yangilanishlarni e'lon qildi, iOS va macOS ning eng yangi versiyalarida jami 286 ta zaiflikni tuzatdi. Shuningdek, kompaniya ishlatilgan zaiflik tuzatmasini iOS 18 ga qayta qo'lladi.
macOS Golden Gate 27.2 263 ta zaiflikni tuzatadi, iOS va iPadOS 27.2 esa 163 ta xatolikni tuzatadi. Taxminan 140 ta xavfsizlik teshigi ikkala operatsion tizim o'rtasida umumiy.
iOS va iPadOS 27.2 yangilanishlari WebKit, yadro va rasmlar, shriftlar, PDF, audio va video fayllarni qayta ishlovchi komponentlardagi ko'plab xotira buzilishi xatoliklarini tuzatadi, ularning ba'zilari ixtiyoriy kod bajarish uchun ishlatilishi mumkin.
Apple shuningdek, ilovalarga sezgir foydalanuvchi ma'lumotlariga kirish yoki maxfiylik afzalliklarini chetlab o'tish imkonini beradigan zaifliklarni, WebContent sandbox'dan qochish, Kerberos KDC taqlid qilish muammosi va yaqin atrofdagi hujumchiga Thread tarmog'iga kirish imkonini beradigan xatolikni ham tuzatdi.
macOS Golden Gate 27.2 ilovalarga root kirish huquqini berishi mumkin bo'lgan o'nlabdan ortiq imtiyoz oshirish zaifliklarini, shuningdek sandbox'dan qochish, Gatekeeper chetlab o'tish va fayl tizimi hamda disk tasviri komponentlaridagi yadro xotira buzilishi muammolarini tuzatadi.
Yangilanish shuningdek, Screen Sharing, Remote Management va SMB'dagi ko'plab xavfsizlik teshiklarini tuzatadi, ular masofadan yoki mahalliy tarmoqdan nishonga olinishi mumkin, jumladan masofadan hujumchiga ixtiyoriy kod bajarish imkonini beradigan Remote Management xatoligi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
iOS va iPadOS 18.7.11 uchta zaiflikni tuzatadi, jumladan CVE-2026-86950, bu Apple "juda murakkab hujum" deb ta'riflagan nol-kun sifatida ishlatilgan.
Meta mahsulot xavfsizligi jamoasi tomonidan aniqlangan zaiflik birinchi marta Apple tomonidan sentyabr oxirida iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 va macOS Sequoia 15.8.1 da tuzatilgan. iOS va macOS 27 ta'sirlanmagan ko'rinadi.
CVE-2026-86950 dan foydalanilgan hujumlar haqida hech qanday ochiq ma'lumot yo'q ko'rinadi.
Apple dushanba kuni shuningdek iOS va iPadOS 26.7.2 (134 ta zaiflik tuzatilgan), macOS Tahoe 26.7.2 (213 ta zaiflik tuzatilgan) va macOS Sequoia 15.8.2 (197 ta xatolik tuzatilgan) ni e'lon qildi.
Texnologiya giganti shuningdek tvOS 27.2 (72 ta zaiflik tuzatilgan), watchOS 27.2 (62 ta zaiflik), visionOS 27.2 (125 ta zaiflik) va Safari 27.2 (33 ta zaiflik) ni ham e'lon qildi.
Bog'liq: Apple AI xavflari fonida macOS'da To'liq Disk Kirishini Qattiqlashtiradi
Bog'liq: Apple Yangi iOS 27, macOS Golden Gate 27 Chiqarilishi Bilan 200 ta Zaiflikni Tuzatdi
Bog'liq: AI Slop Apple Mukofotlarini Cheklaydi
YozganEduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta boshqaruvchi muharrir. U jurnalistika karerasini 2011-yilda boshlashdan oldin o'rta maktab IT o'qituvchisi bo'lib ishlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va elektr muhandisligida kompyuter texnikasi qo'llanilishi bo'yicha magistr darajasiga ega.
Kundalik Brifing Axborotnomasi
Eng so'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek Email Brifingiga obuna bo'ling.
Biznes Email*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Eduard Kovacsdan ko'proq
- PHP2Shell Foydalanishi Tekshiruvlardan Ishlaydigan Shell'larga O'tdi
- Node2Shell: Brotli Zaifligi Microsoft, Node.js, Python Paketlarida Tuzatishni Keltirib Chiqardi
- Mirai Botnet Operatorlari PHP2Shell Hujumlariga Qo'shildi, ASLR Chetlab O'tish Eksploitlari Paydo Bo'ldi
- Atlassian Ma'lumot Markazi va Server Mahsulotlarida 75 ta Xatolikni Tuzatdi
- Eronning Prince of Persia APT C&C ni 2016-yildan Beri Birinchi Marta AQShda Joylashtirdi
- Texnologiya va Xavfsizlik Kompaniyalari PHP2Shell Zaifliklariga Javob Berdi
- Oracle 2026-yil Oktyabr CPU Bilan 1200 dan Ortiq Zaiflikni Tuzatdi
- Google Chrome'ni ClickFix Hujumlari, Xavfsiz Bo'lmagan HTTP Ulanishlaridan Himoya Qildi
Eng so'nggi yangiliklar
- Anthropic Investorlar Uchun Xavflar Bayon Etildi, Jumladan AI'dan Kelayotgan Mumkin Zararlar
- Bu Normal: NetScaler Nol-Kunlari Yangi Normal Haqida Nima Aytadi
- O'lik Popcorn Time Yangilovchisi Millionlab Kompyuterlarni Egallash Xavfiga Qo'ydi
- Dengiz Koalitsiyasi Kema va Port Tizimlari Uchun Bepul Zaiflik Ma'lumotlar Bazasini Ishga Tushirdi
- Kiberxavfsizlik Muammosi Yirik Nyu-Meksiko Kasalxonasini Bemorlarni Boshqa Joyga Yo'naltirishga va Klinikalari Yopishga Majbur Qildi
- Anthropic Potensial Eng Katta IPO Uchun Ariza Topshirdi, CEO AI'dan Insoniyatga Xavf Haqida Ogohlantirdi
- Sanoat Sotuvchilari Mahsulotlarini PHP2Shell Zaifliklari Uchun Tekshirdi
- Genesys Hack Ichki Tizimlardan Mijoz Ma'lumotlarini Fosh Qildi
Kundalik Brifing Axborotnomasi
Eng so'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikr-mulohazalarini olish uchun SecurityWeek Email Brifingiga obuna bo'ling.
Biznes Email*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI Kirish Xavfi Allaqachon Mavjud
19-oktabr, 2026
Google Workspace'ga ulangan AI vositalari millionlab sezgir elektron pochta va fayllarga kirishi mumkin. Tashkilotingizning xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual Tadbir: CISO Forum 2026 Sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiruvchi masalalarni ko'rib chiqish uchun birlashtirganimizda bizga qo'shiling.
Ro'yxatdan o'ting
Harakatdagi Odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber Integratsiya bo'yicha Yordamchi Direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi Ko'proq Odamlar
Mutaxassis Fikrlari
Bu Normal: NetScaler Nol-Kunlari Yangi Normal Haqida Nima Aytadi
Yana bir tur Citrix NetScaler tuzatmalari tez orada chiqarilishi mumkinligi uchun tuzatish quvurlaringizni tayyor saqlang. (Tod Beardsley)
Zamonaviy Kiberhujumlarga Qarshi Kurashda Kalit Tezlik Emas, Balki Yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Zamonaviy Hujumlarga Qarshi Kontekst Qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI Hujum Tezligini O'zgartirdi, Xavfsizlik Asoslarini Emas
AI zaiflik aniqlash va ekspluatatsiyani tezlashtirgan sari, virtual tuzatish hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajak Uchun Katta Rejalar Qilayotgan To'rtta Kiber Tahdid
- AI, ta'minot zanjiri ta'siri, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorlanish kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Mobile & Wireless
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
By
Eduard Kovacs
| October 27, 2026 (7:49 AM ET)
*
Apple on Monday released updates for its operating systems, addressing a total of 286 vulnerabilities across the newest versions of iOS and macOS. In addition, the company has backported the fix for an exploited vulnerability to iOS 18.
macOS Golden Gate 27.2 resolves 263 vulnerabilities while iOS and iPadOS 27.2 fix 163 flaws. Roughly 140 of the security holes are shared across the two operating systems.
The iOS and iPadOS 27.2 updates address many memory corruption bugs in WebKit, the kernel and components that handle images, fonts, PDFs, audio and video files, some of which could be exploited for arbitrary code execution.
Apple also resolved flaws that could let apps access sensitive user data or bypass privacy preferences, along with WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give a nearby attacker access to a Thread network.
macOS Golden Gate 27.2 patches more than a dozen privilege escalation flaws that could give apps root access, as well as sandbox escapes, Gatekeeper bypasses and kernel memory corruption issues in file system and disk image components.
The update also fixes numerous security holes in Screen Sharing, Remote Management and SMB that can be targeted remotely or from the local network, including a Remote Management bug that could allow a remote attacker to execute arbitrary code.
Advertisement. Scroll to continue reading.
iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, which had been exploited as a zero-day in what Apple described as an “extremely sophisticated attack.”
The vulnerability, discovered by Meta’s product security team, was first patched by Apple in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. iOS and macOS 27 do not appear to be affected.
There does not appear to be any public information detailing the attacks exploiting CVE-2026-86950.
Apple on Monday also released iOS and iPadOS 26.7.2, which fix 134 vulnerabilities, macOS Tahoe 26.7.2, which patches 213 vulnerabilities, and macOS Sequoia 15.8.2, with 197 flaws patched.
The tech giant also released tvOS 27.2 (72 vulnerabilities patched), watchOS 27.2 (62 vulnerabilities), visionOS 27.2 (125 vulnerabilities), and Safari 27.2 (33 vulnerabilities).
Related: Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks
Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
Related: AI Slop Limits Apple Bounties
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- PHP2Shell Exploitation Moves From Probes to Working Shells
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- Atlassian Patches 75 Flaws in Data Center and Server Products
- Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Latest News
- Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
- This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
- Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities
- Genesys Hack Exposes Customer Data From Internal Systems
Trending
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
PHP2Shell Exploitation Moves From Probes to Working Shells
SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024
953 Online Stores Infected in Long-Lasting Malware Campaign
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Genesys Hack Exposes Customer Data From Internal Systems
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)