Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
2026-10-01T07:23:59Z•ad9c5e713d2cb0d3073369b5278236f99c15c33cab1692da50ee63ffa2974fcb
CVE-2026-73570CVE-2026-76504CVE-2026-86950CVE-2026-88772AI securityApple CoreGraphicsCisco SD-WANCitrix NetScalerClickFixOAuthRMM abuseZimbraactive exploitationauthentication bypasscommand injectioncredential theftcryptocurrency theftdata exposuremalicious npmphishingremote code executionstate-sponsored activitysupply chainweb shellszero-day
What happened
The feed reports active exploitation of multiple critical vulnerabilities, including Citrix NetScaler pre-authentication flaws, Cisco SD-WAN Manager authentication bypass, Zimbra command injection, and an Apple CoreGraphics out-of-bounds write potentially used in targeted attacks. It also covers ransomware- and espionage-adjacent campaigns, phishing and ClickFix delivery techniques, abuse of legitimate RMM tools, malicious npm packages, OAuth credential theft through MCP servers, cryptocurrency theft, and sensitive-data exposure by AI coding agents. Several issues involve public proof-of-conคว
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- ad9c5e713d2cb0d3073369b5278236f99c15c33cab1692da50ee63ffa2974fcb
- Enrichment time
- 2026-10-01T07:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.