InfoSecBulletin Cybersecurity for mankind
Apple launched iOS 27.2 and iPadOS 27.2 on October 26, 2026, fixing 163 security flaws. The update is for iPhone 11 and newer, along with many iPad models. The biggest issues are in WebKit, which powers Safari and most browsers in Apple apps. Apple warns that harmful web content might run code on a device. This presents a risk of remote code execution, making this update urgent.
Apple shared the complete list in its security document for iOS 27.2 and iPadOS 27.2. The company does not say these flaws are being used in real attacks.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
WebKit RCE Vulnerabilities
WebKit has the most fixes in this update. Apple reports over 30 WebKit problems, and some can allow code execution if a user visits a specially made page. The serious issues include use-after-free mistakes and a type confusion mistake.
The code execution fixes include CVE-2026-112697, CVE-2026-112655, CVE-2026-112651, and CVE-2026-112623, all tied to use-after-free flaws. CVE-2026-112659 is a type confusion issue. CVE-2026-112637, CVE-2026-112626, and CVE-2026-112639 are further use-after-free bugs in WebKit, WebKit Canvas, WebKit JavaScript bindings, and the WebKit process model.
Apple improved them with better memory usage. Thanks go to OpenAI Codex, security researcher Amy Burnett, Chris Rohlf from Anthropic Research, Euntae Jang, Luke Francis, and others.
Two related sandbox issues raise the risk further. CVE-2026-113897 can let a remote attacker break out of the Web Content sandbox. Apple removed the vulnerable code. CVE-2026-112690, reported by Claudio Bozzato and Francesco Benvenuto of Cisco Talos, is listed under App Store and can also let a remote attacker leave the WebContent sandbox. A sandbox breakout matters because code that starts in the browser can then reach more of the device.
Kernel, privacy, and File Vulnerabilities
The kernel fixes are important. About 15 bugs in the kernel are fixed. Some can crash the system or harm kernel memory. There are some use-after-free problems, like CVE-2026-65350, CVE-2026-112679, CVE-2026-112517, and CVE-2026-112514. Others can write to kernel memory or show the kernel memory layout, which helps an attacker plan a bigger attack.
Kernel bugs often require a bad app or an earlier access point, making them less straightforward than a web bug. They are still important in a sequence, where a WebKit bug comes first and a kernel bug follows.
To install the update, go to Settings, tap General, then Software Update, and follow the instructions. It is still smart to do a backup before a major update. Organizations should think of this as an important fix because of the WebKit bugs, the sandbox issues, and the size of the kernel. Apple has a history of large security updates showing the same pattern. Browser and kernel problems come together, and waiting to install gives more chances for misuse.
