IT Daily Roundup – October 2, 2026
1. Apple Patches CVE-2026-86950: CoreGraphics Flaw Exploited in Targeted Attacks
On September 28, 2026, Apple released security updates for iOS 26.7, iPadOS 26.7, and macOS Golden Gate 26.7 addressing critical vulnerability CVE-2026-86950 in the CoreGraphics framework. The flaw lies in inconsistent rounding of floating-point values when processing TrueType fonts embedded in PDF documents – this inconsistency can lead to an out-of-bounds write and potentially allow arbitrary code execution. Apple confirmed the vulnerability "may have been exploited in attacks targeting specific individuals." CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) catalog with a mandatory patch deadline for federal agencies of October 2, 2026 – today. Researchers have since published a proof-of-concept demonstrating a crash, which may help attackers develop a more complete exploit.
Why this matters: If your organization uses iPhones, iPads, or Macs – and the vast majority of SMEs have at least some Apple devices in use – this update should be installed today, not "whenever." The PDF attack vector is particularly dangerous in a business environment where invoices, contracts, and reports are exchanged daily. Practical step: check Settings → General → Software Update on company devices to verify they are on the latest version. If you manage devices via MDM (Jamf, Apple Business Manager), push the update via policy rather than relying on employees to do it themselves.
2. Cisco Catalyst SD-WAN Manager: Critical Auth Bypass (CVSS 9.8) Actively Exploited
Cisco has warned of a critical vulnerability CVE-2026-76504 (CVSS 9.8) in Catalyst SD-WAN Manager, the software used to centrally manage SD-WAN networks. The flaw stems from improper handling of URL encoding in HTTP requests: an unauthenticated attacker can send a specially crafted request, bypass authentication, and gain full administrative access to the management console. Cisco confirmed active exploitation began in September 2026 and CISA added the vulnerability to its KEV catalog – the patch deadline for federal agencies is October 3, tomorrow. This marks the eighth Cisco SD-WAN vulnerability added to KEV in 2026, suggesting attackers view this platform as a particularly attractive target. Cisco recommends immediate upgrading to a patched release and auditing logs for indicators of compromise – specifically, suspicious POST requests to the /j_security_check endpoint.
Why this matters: Cisco Catalyst SD-WAN solutions are commonly used by organizations with multiple branch offices or hybrid internet connectivity – precisely the type of infrastructure that IT outsourcing providers typically manage for mid-sized businesses. A compromised SD-WAN Manager gives an attacker a complete map of your entire network topology and access paths into every part of the network. If your infrastructure includes Cisco SD-WAN, verifying the software version and applying the patch is a today action – not something to defer to the next scheduled maintenance window. This is exactly the type of urgent situation where calling your IT partner out of cycle makes sense.
3. European Police Arrest 16-Year-Old Operator of KillSec Ransomware Gang
Spanish and British police, in cooperation with Europol, arrested three members of the KillSec ransomware gang on September 30, 2026: the suspected 16-year-old main operator from Alicante, Spain; a man in his twenties from the United Kingdom; and a 24-year-old from Romania. KillSec started as a hacktivist group in 2021 and from June 2024 offered a ransomware-as-a-service (RaaS) model, renting its infrastructure and malware to other attackers (affiliates) for a fee. The gang used AI tools to identify targets and build infrastructure, purchased stolen credentials on the dark web, and exploited software vulnerabilities and insecure cloud storage. Investigators recorded approximately 1,000 suspected attacks with 500+ confirmed breaches; Spanish authorities identified 280 victims and seized at least 110 terabytes of stolen data. One Catalan organization suffered damages approaching €1 million.
← All postsWhy this matters: The takedown of KillSec operators is good news, but it does not mean the ransomware threat is declining. The RaaS model means that even after the main operator is arrested, dozens of affiliates continue attacking through a different backend. The fact that the main operator was a 16-year-old is a stark warning: today's AI tooling enables launching a sophisticated ransomware operation without deep technical knowledge – an algorithm selects victims, not a seasoned hacker. Two practical lessons for SME businesses: backups with regularly tested recovery and network segmentation are fundamental protections, not luxuries; and no organization is "too small" to attract a ransomware gang's interest – automated scanners search for vulnerable systems around the clock.