SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)

Apple releases updates for all its operating systems, addressing 304 vulnerabilities, including one that is actively being exploited in Core Graphics. While Apple shows a slight increase in the frequency of patches, the overall rise in reported vulnerabilities is not as significant as seen with other vendors. Notable issues include unauthorized camera access and potential local access to users' keychain items, raising concerns about privacy and security.

Additionally, an intern from the SANS Institute, Jeffrey Spence, shares insights on threat hunting using the D-Shield Seam honeypot. He explains how to utilize Elastic Surge's query language to identify and analyze HTTP requests based on language preferences, which can help in tracking threat actors.

Microsoft also issues an out-of-band patch for .NET, addressing a vulnerability in a widely used decompression algorithm. This vulnerability also affects PHP, particularly in its Windows version, leading to updates in the PHP binary to ensure safety. The discussion highlights the ongoing need for vigilance in software updates as vulnerabilities continue to emerge.

In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.

Apple Patches for October 2026: 304 Vulnerabilities Fixed

Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).

https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/

Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK

In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.

https://isc.sans.edu/diary/Looking%20for%20a%20Language%20%5BGuest%20Diary%5D/33442

More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)

Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.

https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

https://www.php.net/archive/2026.php#2026-10-26-1

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich