InfoSecBulletin Cybersecurity for mankind
Meta-owned WhatsApp has released two new security warnings about flaws fixed earlier this year in the well-known messaging app. One issue is CVE-2026-23863, a medium-risk attachment spoofing problem that affects WhatsApp for Windows before version 2.3000.1032164386.258709.
An attacker could use the flaw to make a harmful document with NUL bytes in its name. When sent as an attachment, the receiver would think it’s a safe file, but it would run as a program when opened, WhatsApp’s notice says.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
The second flaw, CVE-2026-23866, has a ‘medium impact’ rating. It impacts WhatsApp for iOS (v2.25.8.0-v2.26.15.72) and WhatsApp for Android (v2.25.8.0-v2.26.7.10).
According to WhatsApp, incomplete validation of AI rich response messages for Instagram Reels could have allowed an attacker to “trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers.”
WhatsApp has not given more details, but these custom URL problems could let bad actors send users to fake sites and open other apps on the device using URL schemes like facetime:, tel:, itms-apps:, or special app links.
The company states there is no proof of abuse in nature.
