Zero-days, malicious documents, and a social trend gone sideways. |
From chained exploits and silent Word payloads to macOS malware-for-hire and a decades-old image bug resurfacing, today’s roundup shows how quickly small cracks turn into wide-open doors.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Apple Patches Zero-Day Used in Live Attacks |
Apple released an emergency patch after confirming a zero-day was used in “extremely sophisticated” targeted attacks. CVE-2026-20700 impacts dyld, Apple’s Dynamic Link Editor, enabling arbitrary code execution across iOS, iPadOS, macOS, and other platforms. |
Apple confirmed the flaw was chained with two previously patched CVEs in targeted attacks, affecting iPhone 11 and later, select iPads, and Macs running macOS Tahoe.
Apply the patch, block noncompliant devices with conditional access, and layer mobile threat defense, MFA, and zero trust solutions to reduce risk. |
Microsoft Patches Actively Exploited Word Vulnerability |
Microsoft has patched an actively exploited Word vulnerability that lets malicious documents bypass OLE protections and run without standard security warnings.
Tracked as CVE-2026-21514, the flaw results from improper validation of untrusted inputs, allowing attackers to manipulate how Word handles embedded COM/OLE objects. Exploitation requires only that a user open a crafted document, and Microsoft confirmed active attacks in the wild.
Apply the patch, disable or restrict OLE where possible, enforce attack surface reduction rules, and monitor endpoints for suspicious Word process activity. |
Viral AI Trend Exposes Shadow AI Risk |
A lighthearted social media trend is inadvertently exposing how employees use public AI tools for work. Millions are prompting ChatGPT to create caricatures “based on everything you know about me” and sharing the results, potentially exposing unsanctioned LLM use and sensitive business data. Researchers warned these posts offer reconnaissance value, helping attackers target high-value professionals with phishing or credential-harvesting campaigns.
Implement formal AI governance, provide a sanctioned enterprise LLM, and enforce MFA, DLP, and monitored network controls to prevent sensitive data leakage through shadow AI use.
|
| |
If your team’s using public LLMs today… |
|
|
Yesterday's Pulse Check Results |
If someone targeted your VPN or SSO tonight… |
|
|
Security Tools You Can Use |
|
|
Criminal Market Fuels macOS Infostealers |
A growing underground market is fueling macOS infostealers that harvest credentials, Keychain data, and cryptocurrency wallets at scale.
Flare researchers say these threats have matured into a full malware-as-a-service ecosystem with subscription panels, affiliate programs, revenue sharing, and even signed malware that bypasses Gatekeeper. |
The campaigns also abuse trusted platforms — from compromised WordPress sites to blockchain-based C2 — and prioritize crypto theft.
Deploy macOS-focused EDR with deep telemetry, enforce strict allowlisting and MFA, and monitor for abnormal Keychain access, signed app abuse, and suspicious outbound traffic to reduce infostealer risk. |
Legacy Libpng Flaw Triggers RCE Risk |
A nearly 30-year-old heap buffer overflow in libpng can trigger denial-of-service crashes and potentially remote code execution via crafted PNG files.
Tracked as CVE-2026-25646, the flaw in png_set_quantize() stems from improper color index handling during quantization and carries potential supply chain implications. Proof-of-concept code has been released by researchers.
Upgrade to the latest version, validate dependencies via SBOM review, and sandbox plus monitor image processing workflows to reduce exploitation risk from crafted PNG files. |
|
|
How Secure Are Your macOS Endpoints? |
From credential-stealing malware to signed infostealer variants that slip past traditional trust controls, Macs are now firmly in attackers’ sights across the enterprise. As Macs proliferate across departments, failing to harden them creates measurable enterprise risk. |
How to harden macOS environments: |
-
Enable FileVault and enforce System Integrity Protection to protect data at rest and prevent unauthorized system-level changes.
- Deploy macOS-compatible EDR and implement application allowlisting to monitor behavior and restrict unapproved or malicious software execution.
-
Apply least privilege and harden browser and extension policies to limit credential exposure and reduce opportunities for persistence or escalation.
|
Proactive macOS hardening helps reduce the attack surface and address common gaps, allowing security teams to manage Macs with the same level of control as other enterprise endpoints. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
