WebKit vulnerabilities refer to security flaws in Apple’s web rendering engine, which powers Safari, Mail, and the App Store on iOS and macOS.
What this means is that the CVE-2026-20643 vulnerability makes it possible for a malicious website to pretend to be another site, maybe one you trust, and then read or steal information that should be kept separate. Normally, browsers enforce a rule called the “same‑origin policy,” which is like a strict fence that stops one site from peeking into another site’s data. This bug could help cybercriminals cut through that fence. In practical terms, an attacker would first have to lure you to a specially crafted web page.
Read more…
Source: Malwarebytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session
November 9, 2026
Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and ...
- Chrome 157 fixes 213 security issues, including 7 critical flaws
November 4, 2026
On November 3, Google issued Chrome 157 to the stable channel for Windows, Mac and Linux. The update is rolling out over the coming days and weeks. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 157.0.8103.38/.39 for Windows and Mac and 157.0.8103.38 for Linux. It includes 213 security fixes, including seven vulnerabilities rated Critical by ...
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
November 2, 2026
On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527, classified as generation of ...
- ‘SMS of Death’ exploit can remotely crash unpatched Android phones
November 2, 2026
A zero-click Android flaw let attackers crash phones with a specially crafted SMS message. Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity. Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable. Read more… Source: Tech Radar Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered right ...
- Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated)
October 29, 2026
Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, referred to as PHP2Shell. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). Researchers encourage reviewing the PHP Group’s security advisory and patching guidance. PHP is widely used across web servers and content management systems globally. Researchers recommend assessing your ...
- Hackers are breaking into company networks via hacked CCTV camera software
October 29, 2026
Attackers abused camera management software to gain initial access and establish persistence on networks. Campaign used DLL sideloading and reverse shells to evade detection and maintain control. Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity. Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...