# IT Daily Roundup – September 29, 2026

> Sep 29, 2026 · #apple #security #cloud

Apple patched an actively exploited CoreGraphics zero-day, TeamFiltration compromised forgotten M365 service accounts without MFA, and 16,000+ Supabase databases are leaking sensitive business data.

## 1. Apple Patches CoreGraphics Zero-Day: Update iOS, iPadOS, and macOS Immediately

On September 28, Apple released security updates — iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 — patching CVE-2026-86950, an out-of-bounds write vulnerability in the CoreGraphics component. The flaw enables arbitrary code execution when a user opens a specially crafted file. Apple confirmed the vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals," making this an actively exploited zero-day. Affected devices include iPhone 11 and later, iPad Pro (3rd gen+), iPad Air (3rd gen+), iPad (8th gen+), iPad mini (5th gen+), and Macs running macOS Sequoia and Tahoe.

> **Why this matters:** Even though Apple describes "targeted attacks against specific individuals," history shows that CoreGraphics and WebKit zero-days quickly migrate into broader exploitation — including spyware like Pegasus, which was distributed through seemingly harmless files. For any business with iPhones and Macs in the workplace, the action is simple: update all devices immediately. We recommend configuring MDM solutions (e.g., Jamf) to enforce security updates automatically, so no device on the network remains unpatched more than 24 hours after a release.

## 2. TeamFiltration Compromises Forgotten Microsoft 365 Service Accounts in Under 7 Minutes

Security researchers documented an active campaign by threat group UNK_CondorFiltration using the TeamFiltration framework — a cross-platform tool for password spraying and data exfiltration from Microsoft 365 tenants. Attackers leveraged 1,487 unique AWS EC2 addresses to conduct large-scale password spraying, targeting exclusively forgotten service accounts and functional accounts with default or never-rotated passwords and no multi-factor authentication (MFA). Six of seven compromised accounts were breached in under 7 minutes — suggesting shared default passwords. The campaign scanned more than 5,700 accounts across 28 Microsoft 365 tenants. After gaining access, attackers immediately accessed OneDrive, Teams, and SharePoint, probed the Azure Portal, and requested Microsoft Graph API tokens.

> **Why this matters:** This campaign is a direct warning for any organization that has ever provisioned a Microsoft 365 service account or functional account — for a printer, a CRM integration, automated reports — and then forgotten about it. These accounts typically have the same access to files, email, and shared drives as a regular employee, but without monitoring and without MFA. Recommended action: review your Azure Entra ID Admin Center user list; identify all service and functional accounts; deactivate any that are no longer in active use; and enable MFA on all remaining ones. This is a half-day task that can prevent a breach with company-wide consequences.

## 3. Over 16,000 Supabase Databases Leaking Business Data: Missing Security Policies and AI-Assisted Development to Blame

Researchers discovered that more than 16,000 databases built on Supabase — a popular open-source alternative to Firebase for web and mobile applications — are misconfigured and publicly exposing sensitive data. Exposed records included customer personal data, plaintext passwords, authentication tokens, and payment card information. Researchers analyzed approximately 300,000 domains using Supabase and identified a systemic issue: missing or ineffective Row-Level Security (RLS) policies and misuse of public API keys. A particularly alarming finding: over 60% of newly created misconfigured databases originated from AI-assisted development, where AI tools generate functional code but typically don't address database security configurations.

> **Why this matters:** For SMEs that outsource web application or internal tool development to agencies or freelancers, this report is an important reminder. If the developer focuses on delivering features, database security settings often remain at their defaults — leaving customer data fully exposed. Recommended action: ask your development partner whether Row-Level Security policies are configured in your database; require a security review of database access permissions before launching any new product; and never store sensitive data (passwords, tokens, payment info) without encryption and strict access controls. Database security is not an optional feature — it's the foundation of customer trust.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-29-it-daily-roundup.html