Apple Backports CoreGraphics Zero-Day Fix as CISA Flags PHP2Shell

Enterprise and mobile defenders confronted five major vulnerability and threat disclosures on Tuesday spanning Apple iOS hardware, PHP web servers, on-premises Microsoft SharePoint, European energy infrastructure, and mobile malware:

1. Apple Backports CVE-2026-86950 CoreGraphics Zero-Day to Older Devices

Apple released backported security updates for iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation), iPad Air (4th generation and later), iPad (9th generation and later), and iPad mini (6th generation and later) to fix CVE-2026-86950, an out-of-bounds write flaw in CoreGraphics discovered by Meta Product Security and exploited in “extremely sophisticated” targeted attacks prior to iOS 27, according to BleepingComputer. Apple previously patched the bug in September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.

2. CISA Adds PHP2Shell Flaws to KEV With Thursday Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency added critical remote code execution flaws CVE-2026-109618 and CVE-2026-109619—collectively tracked as PHP2Shell and patched by the PHP security team on Oct. 21—to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, ordering Federal Civilian Executive Branch agencies to patch by Thursday, according to BleepingComputer. Amazon Threat Intelligence noted attackers targeted the flaws four days before patches shipped, Perplexity’s Adel Karimi observed RCE against Apache mod_php on PHP 8.4.26, and the PHP team also shared mitigations Friday for an unpatched RCE flaw, CVE-2026-115560.

3. Storm-2603 Warlock Ransomware, ENGIE Partner Breach, and ZloyRAT Android Trojan

In an analysis for CyberScoop, Ron Reinfeld detailed how the China-linked group Storm-2603 deployed Warlock ransomware against at least four organizations—including a water utility, a telecom provider, a regional government body, and a university across Portuguese- and Spanish-speaking countries—by exploiting on-premises Microsoft SharePoint (including July 2025 ToolShell flaws) and using a vulnerable signed driver after nine days of dwell time to disable endpoint security sensors across 40 machines in two hours before encrypting data.

Meanwhile, French energy provider ENGIE (€71.9 billion annual revenue) confirmed to BleepingComputer that attackers stole French customers’ names, contact details, customer IDs, contract numbers, and Delivery/Metering points (PDL/PCE) from an external partner marketing platform without breaching ENGIE’s internal IT systems or banking data. Separately, researchers at Russian cybersecurity firm F6 reported to The Record that threat actors registered a site in early October distributing the ZloyRAT Android trojan—which targets SMS, calls, Telegram, and more than 60 banking apps—inside fake apps posing as fuel-station and traffic-patrol finders, GosuVPN, and Drone Radar.