Loki Intelligence — Security Briefs · Published
Daily Security Brief: Apple KEV, RouterOS RCE, and Post-Quantum Planning
Today's risk picture pairs an actively exploited Apple CoreGraphics flaw and a critical pre-authentication RouterOS bug with an LTE base station issue that has no planned fix. Teams should prioritize device and router patching and exposure reduction while starting the cryptographic inventory work that post-quantum migration will require.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-86950, an out-of-bounds write affecting Apple iOS, iPadOS and macOS, to the KEV catalog based on evidence of active exploitation. The catalog entry notes that the CoreGraphics flaw may lead to arbitrary code execution on affected devices.
Why it matters: Enforce minimum OS versions through mobile device management and verify patch compliance for both corporate and personal Apple devices that access company data.
Source: CISA
Signal 02 · CISA
Baicells Nova 430H
CISA's advisory for the Baicells Nova 430H eNodeB (model pBS3101SH, BaiBLQ_3.0.12 and earlier) covers CVE-2026-96274: an unauthenticated device within radio range can send a malformed uplink message that disrupts the cell's signaling link to the core network. Baicells has not responded to CISA, and no fix is planned.
Why it matters: Operators of private LTE networks should record this as an unfixed availability risk, contact the vendor, monitor for signaling disruptions, and plan resilience or replacement.
Source: CISA
Signal 03 · CISA
MikroTik RouterOS
CISA warned of CVE-2026-84411, a CVSS 9.8 integer underflow in the RouterOS web management service that is reachable before authentication in versions earlier than 7.24, the release MikroTik recommends upgrading to. A single crafted request could let an unauthenticated attacker run code as root or crash the device.
Why it matters: Upgrade RouterOS to 7.24, block web management access from untrusted networks, and include routers in routine vulnerability scanning and asset inventory.
Source: CISA
Signal 04 · GitHub Security
How we found 24 Android vulnerabilities using our open source AI security agent
GitHub Security Lab shared how targeted audit taskflows guided an LLM to find 24 vulnerabilities in Android apps, including a flaw letting any installed app silently change OsmAnd settings and leak location data, and a Wikipedia app deeplink issue that could expose session cookies. The author notes LLMs often misjudge severity.
Why it matters: Use AI-assisted audits to widen coverage of mobile entry points, but require reviewers to confirm exploitability and severity before triaging or reporting findings.
Source: GitHub Security
Signal 05 · The Hacker News
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Apple released iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to fix CVE-2026-86950, a CoreGraphics out-of-bounds write reachable through crafted files. Apple said it is aware of a report of possible exploitation against targeted individuals and credited Meta Product Security with the discovery.
Why it matters: Accelerate updates for older iPhones, iPads and Macs, since the reported exploitation targeted versions before iOS 27, and confirm high-risk users are not lagging behind.
Source: The Hacker News
Signal 06 · Cloudflare Security
Using AI to chart a course for our post-quantum migration
Cloudflare described CryptoLabe, an internal AI tool that scans its repositories to discover how cryptography is used, classify classical versus post-quantum usage, and flag prerequisites and hard cases for its 2029 post-quantum readiness target. The team found simple pattern searches both overcount and miss indirect uses in configuration and dependencies.
Why it matters: Start a cryptographic inventory now, covering configuration defaults, signed tokens such as JWTs, and size-constrained fields, so post-quantum migration blockers surface well before deadlines.
Source: Cloudflare Security
Signal 07 · Cloudflare Security
Building a post-quantum certificate authority with Merkle Tree Certificates
Cloudflare said its new certificate authority will support Merkle Tree Certificates, a draft IETF design for compact post-quantum authentication, targeting early 2027 inclusion in Chrome's Quantum-resistant Root Store. An earlier experiment with Chrome served billions of MTCs and found them about 9% faster at median than classical certificate chains.
Why it matters: PKI and platform teams should track post-quantum root program developments and monitor certificate transparency logs for unexpected legacy certificates on domains that have been upgraded.
Source: Cloudflare Security
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.