Podcast Detail

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10152.mp3

previous
Podcast Logo
Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.

Apple Patches for October 2026: 304 Vulnerabilities Fixed
Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).
https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/

Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK
In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.
https://isc.sans.edu/diary/Looking%20for%20a%20Language%20%5BGuest%20Diary%5D/33442

More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)
Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
https://www.php.net/archive/2026.php#2026-10-26-1


My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Tuesday October 27th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recorded today from Denver,
 Colorado. And this episode comes to you from the SANS.edu
 Grad Certificate Program in Penetration Testing and
 Ethical Hacking. Well to start out with today we got patches
 from Apple. Apple released updates to all of its
 operating systems and with that patched 304 different
 vulnerabilities. Now one of the things of course we always
 look for these days is how many more vulnerabilities we
 get now than before due to AI being used in order to
 discover these vulnerabilities. While we do
 see an increase in the number of vulnerabilities being
 patched by Apple it's not really as many more as we have
 seen from other vendors. There's a slightly higher
 frequency in patches with Apple and overall the number
 of patches per release well maybe sort of doubled but it
 sort of went up and down a lot for Apple in general so may
 have to wait a little bit longer to see a cleaner trend
 here to really check what's going on. But of course with
 other vendors we have sort of more seen an order of
 magnitude change so Apple definitely doesn't really see
 that huge of an increase in number of vulnerabilities
 reported. There are sort of three interesting or
 noteworthy issues here. Now first of all there is one
 vulnerability that's already being exploited in Core
 Graphics. This is not a new vulnerability. About a month
 ago Apple did patch it in current versions of iOS and
 what this release does is it basically now also patches it
 for iOS 18. So we got older versions of iOS covered here.
 There are two vulnerabilities that I thought were a little
 bit different and interesting. One is an access to the camera
 without user permissions. It doesn't really give you a lot
 of details whether or not for example the camera icon or so
 is visible as recording or not but that's certainly always
 sort of a concern with particular laptops and mobile
 devices with a built-in camera. Then secondly we do
 have a local attacker may gain access to users Keychain
 items. Interesting issue here you know if you think about
 that we trust Keychain with passwords so certainly would
 like to know a little bit more about what exactly is being
 given access to here but yeah as usual patch nothing else
 really you can do with this and there is no sort of you
 know individual patches for individual vulnerabilities
 just update the operating system of course with these
 updates in particular for the current operating system also
 come some new features these are not just security updates
 for older operating systems it's typically just a security
 update. And we got a second diary today this diary comes
 from one of our undergraduate interns Jeffray
 Spence and Jeffray is writing well basically about how to do
 sort of threat hunting in our DShield SIEM honeypot. The
 SIEM uses Elasticsearch and the typical sort of Elastic
 front end with that of course you have access to Elastic's
 query language and are able to dissect and search the data
 that's stored in Elastic and Jeffray does a real good job
 sort of showing you some approaches how to essentially
 find interesting events looking for example for the
 Accept-Language headers in HTTP requests to identify and
 isolate certain requests that have certain language
 preferences which of course then can lead to threat actors
 that happen to use this particular language preference
 in requests they're sending and with that Jeffray is going
 further into the data trying to identify related events and
 essentially identify different threat actors interesting and
 very detailed diary in particular if you're new to
 tools like Elasticsearch and ELK well this is a nice way to
 sort of get introduced to the capability of this system well
 whenever we are dealing with a big event like last week's PHP
 issues there's always the second question well what did
 we miss and I think one issue that sort of wasn't really
 covered well because of everybody focused on PHP was
 the Brotli vulnerability that I mentioned yesterday on
 Sunday Microsoft actually released an out of band patch
 for .NET covering .NET eight nine and ten also the 11
 release candidate three fixing this Brotli decompression
 algorithm vulnerability PHP actually was also affected and
 PHP itself does not implement this algorithm but does use
 the library at least apparently in the Windows
 version it was vulnerable and what PHP did is that they
 repackaged the PHP binary for Windows using the updated
 Brotli library they didn't change the version of this
 library so you have to compare hashes to make sure that you
 are using the up-to-date and Brotli safe I guess we call
 it version of this library so keep looking for updates of
 various vendors there's a very commonly used compression
 algorithm compression library so we'll probably see more and
 more of this come out over the next few weeks well and that's
 it for today thanks for listening thanks for liking
 thanks for recommending this podcast and talk to you again
 tomorrow bye