# IT Daily Roundup: October 24, 2026 > Oct 24, 2026 · #apple #security #nodejs #sap #cloud Apple patched 75 security flaws in iOS 26.6, SAP fixed a CVSS 10 SSRF vulnerability in its Python Cloud SDK, and Node.js released patches for an RCE flaw in the bundled Brotli decoder. ## 1. Apple releases iOS and iPadOS 26.6 with fixes for 75 security flaws Apple released iOS 26.6 and iPadOS 26.6. The update covers 75 security vulnerabilities across WebKit, the kernel, Cloud Attestation, AuthKit and Foundation. The affected flaws could allow data theft, denial of service or unauthorized access to personal data through malicious websites or apps. Apple has not disclosed whether any of these issues are being actively exploited or which flaws are the most severe. The update is available for iPhone 11 and later, as well as compatible iPad models. The download is around 23 GB. You need a Wi-Fi connection, a charged battery and sufficient free storage. For managed devices in MDM (Microsoft Intune, Jamf), set up update approval or push the update command to users. > **Why this matters:** 75 patches at once is above average. Company iPhones with access to email, VPN or internal apps should be updated, and an MDM setup can handle that for you. ## 2. SAP Cloud SDK for Python has a CVSS 10 SSRF flaw: OAuth2 tokens can reach an attacker SAP fixed CVE-2026-89111, an SSRF vulnerability in the Cloud SDK for Python, as part of its October 2026 security notes. By controlling the `tenant_subdomain` parameter, an attacker can redirect OAuth2 token requests to a server they control and capture client credentials. The issue affects multi-tenant applications on SAP Business Technology Platform (BTP) built with this SDK. The fix is part of the October 2026 Security Patch Day. Exact version numbers are in SAP's October 2026 Security Notes. As a temporary workaround, validate `tenant_subdomain` against an allowlist of registered tenant subdomains. The same update batch also includes CVE-2026-89110, a critical flaw in NetWeaver Visual Composer that allows a remote attacker with limited privileges to fully take over the system, and CVE-2026-89108 affecting SAP Manufacturing Integration and Intelligence. > **Why this matters:** SAP BTP is a foundation for custom cloud applications and system integrations. A CVSS 10 flaw requiring no special privileges is not something to carry into next month's maintenance window. If your team or a vendor is building BTP applications in Python, check the SDK versions and apply the fix now. ## 3. Node.js patches Brotli decoder flaw across versions 22, 24 and 26 Node.js released security updates 22.23.4, 24.22.1 and 26.12.1. The main fix is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. Malformed compressed input can trigger the overflow and lead to remote code execution. The severity is rated High. No active exploitation has been reported, but a public proof-of-concept achieved code execution on test builds. The update also addresses three other High-severity issues: two TLS hostname-check bypasses and a `dns.resolve` null-byte truncation bug. Node.js 20 and older versions will not receive the fix, as they are end-of-life. If your server runs Node.js 20, this is another reason to move to a supported branch. > **Why this matters:** Brotli decompression is commonly used in Node.js when processing responses from external APIs. If an application decompresses input from sources outside your control, patching makes sense. Contact your developer or DevOps team and check which version is running. --- © 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-24-it-daily-roundup.html