SAP Patches Four Maximum-Severity Flaws Including ICM2SHELL and PROXYGATE in November 2026 Updates

Binance Warns of Unpatched iOS Sandbox Escape worse_query Exposing Crypto Wallet Keys on iOS 26 and 27

Binance has issued a security advisory about an iOS sandbox escape vulnerability called worse_query that enables malicious apps to read files from other applications, including crypto wallets containing seed phrases, private keys, and credentials. The proof-of-concept exploit, published by researcher forcequit on GitHub, works on iPhones running iOS 26 and iOS 27 without requiring a jailbreak or kernel exploit. Apple's recent updates for iOS 26.7.3 and iOS 27.2.1, released yesterday, do not address the issue according to the official security notes. Apps built on the exploit, such as the WQ Files file manager by developer Christoph Kolbicz, can be installed via sideloading tools like AltStore and SideStore that automatically configure the required App Group container. Binance advises users to remove any sideloaded or untrusted apps, update all software, and move funds to a new wallet on a clean device if a breach is suspected. Neither Apple nor the researcher has confirmed any in-the-wild attacks or thefts involving the vulnerability.

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has released multiple security updates addressing critical flaws in iMessage that could allow unauthorized access to group chat messages. One vulnerability, tracked as CVE-2026-113961, is an authorization issue that permitted remote attackers to join group chats and receive ongoing messages through improved validation fixes. A second issue, CVE-2026-113960, enabled newly added participants to access messages sent before they joined the conversation. The updates also resolve an out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalog on October 27. Additionally, nine separate updates address multiple Bluetooth and AirPlay vulnerabilities that could enable unauthorized pairing or memory corruption without user interaction. The company has not confirmed active exploitation of the iMessage or Bluetooth issues and provided no workarounds for users unable to update immediately.

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.