AI Weekly Malaysia

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.

Why: If you ship iOS or macOS apps that render untrusted PDFs or fonts, the concrete decision is: confirm your users are on iOS 26.7.1 or later, because there is no described workaround for anyone stuck on older builds. The root cause is more useful than the CVE itself — two of eight near-identical rasterizer functions handled out-of-range glyph coordinates differently (one saturated, one truncated), producing a bounding box too narrow and an undersized buffer. If you own any float-to-fixed-point or unit-conversion code, that saturate-vs-truncate split, and the fact that one fix had to be duplicated 20+ times, is a specific review target.

CISA added CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog on Wednesday after Cisco confirmed active exploitation in September 2026. The flaw is a hex/URI-encoding handling bug: a crafted HTTP request to the API lets an unauthenticated remote attacker act as the admin user. Cisco published IoCs but not victim counts or attribution, and U.S. federal civilian agencies had until October 3, 2026 to patch — a two-day window. watchTowr's Jake Knott noted eight Cisco SD-WAN CVEs have hit KEV in 2026 alone.

Why: If you or a client run Cisco Catalyst SD-WAN Manager, this is a same-day patch plus log check: grep /var/log/nms/containers/service-proxy/serviceproxy-access.log and /var/log/nms/vmanage-server.log for j_security_check calls from unknown IPs and for usernames starting with 'viptela-reserved-'. If you don't run that appliance, nothing here changes your week — it is enterprise network gear, not developer tooling, and the useful signal is the pattern (eight SD-WAN CVEs on KEV this year) for anyone doing MSP or enterprise infra work.

watchTowr published exploit details for CVE-2026-88772 (CVSS 9.5), a pre-auth memory overflow in Citrix NetScaler ADC and Gateway's DTLS handshake handling inside the NetScaler Packet Processing Engine (NSPPE), which CISA says is under active exploitation in the wild. The bug is a parsing inconsistency: the handshake header's length field declares a 120-byte message while each fragment's fragment_length field says 1 byte, so reassembly stitches roughly 174 KB of NetScaler Buffer data into a scratch buffer of only 35,840 bytes because the vulnerable version never checks whether the next packet fits. Individual packets are 1,459 bytes, and the flaw can lead to remote code execution or denial-of-service.

Why: If you or your employer don't run NetScaler ADC or Gateway, nothing in your stack changes this week — this is a patch-now item only for teams with that appliance in front of their services, since the path is pre-auth and exploitation is already observed. The transferable lesson is narrow and concrete: the overflow happens because the code trusted a declared per-fragment size (1 byte) while keeping the whole 1,459-byte record, so if you write any upload, websocket, or protocol reassembly handler, check whether you validate declared lengths against what you actually copy into a fixed buffer.