Cyber news on October 27, 2026

1. 0111:55 UTC

   Game studio disclosures compared after Warhorse confirms attack

   16 outlets · first: dev.ua Security

   Reported by dev.ua, PC Gamer, GamesRadar+, Kotaku, GamingOnLinux, Shacknews, and 10 more outlets.

   • Warhorse Studios
   • Kingdom Come: Deliverance 2

   Full coverage: every report, when each was published, and who was named (16 outlets)

2. 0210:36 UTC

   Apple backports CoreGraphics zero-day fix to older iPhones

   2 outlets · first: bleepingcomputer.com Vulnerability

   Machine summary Apple shipped iOS and iPadOS 18.7.11 on Monday with a backported fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics that the company said may have been used in extremely sophisticated attacks against targeted individuals on iOS versions before iOS 27. Meta's product security team reported the flaw, which Apple first patched in late September in iOS 26.7.1 and related releases.

   1. Apple's Monday updates address 286 vulnerabilities in total, with macOS Golden Gate 27.2 resolving 263 and iOS/iPadOS 27.2 fixing 163, about 140 of them shared (SecurityWeek).
   2. iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta's product security team (SecurityWeek, BleepingComputer).
   3. Apple initially addressed CVE-2026-86950 at the end of September through iOS 26.7.1 and iPadOS 26.7.1, alongside macOS Tahoe 26.7.1 as well as macOS Sequoia 15.8.1; SecurityWeek reports that iOS and macOS 27 apparently are not affected.
   4. iOS and iPadOS 26.7.2 fix 134 vulnerabilities, and the 27.2 updates include WebKit, kernel and media-parsing memory corruption bugs, WebContent sandbox escapes and a Kerberos KDC impersonation issue (SecurityWeek).
   5. BleepingComputer reports Apple has now patched two zero-days exploited in attacks this year, the second being CVE-2026-20700 in dyld, fixed in February.

   Reported by bleepingcomputer.com and securityweek.com.

   • Meta
   • Apple
   • CoreGraphics
   • dyld
   • CVE-2026-86950
   • CVE-2026-20700

3. 0300:04 UTC

   Cohesity says IBM validated its cloud rebuild for Terraform

   2 outlets · first: Securitybrief Australia Security Mostly press releases

   Machine summary Cohesity announced on October 27, 2026 that HashiCorp, an IBM company, validated interoperability between Cohesity Data Cloud's cloud rebuild capability and Terraform Self-Managed. The company describes a recovery flow in which approved infrastructure-as-code recreates the declared configuration and backup restores the latest usable application data.

   1. Cohesity announced on October 27, 2026 that HashiCorp, an IBM company, validated interoperability of Cohesity Data Cloud's cloud rebuild capability with Terraform Self-Managed (Cohesity announcement).
   2. Per the announcement, IBM has validated this as the first cloud recovery technique achieving interoperability with Terraform Self-Managed, a self-hosted system for declaring and administering cloud infrastructure through code.
   3. As the company outlines it, Terraform rebuilds the declared configuration using infrastructure-as-code files that were reviewed and approved, while Cohesity Data Cloud restores the newest usable application data from backup.
   4. Cohesity states the combined process returns an application to a trusted state rather than to a production copy that may already contain an attacker's changes.
   5. The same survey found 3% of respondents said their recovery plans are ready today; cloud rebuild is stated to be part of Cohesity Data Cloud Enterprise Edition.

   Reported by Securitybrief Australia and Pr Newswire.

   • IBM
   • Cohesity
   • Terraform Self-Managed
   • Cohesity Data Cloud Enterprise Edition
   • Cohesity Data Cloud
   • HashiCorp

4. 0420:25 UTC

   Code-execution flaw rated 9.5 found in UEFI firmware base

   2 outlets · first: Ars Technica Vulnerability

   Machine summary Ars Technica and Techzine Global report a memory-corruption flaw, tracked as CVE-2026-97631 and scored 9.5 out of 10, in the TianoCore EDK II codebase used to build UEFI firmware for most server vendors. According to Ars Technica, code run through the vulnerable ICMP component executes before Secure Boot and Trusted Platform Module defenses load, and the researchers who found it had planned a coordinated disclosure for January before AMI published a pull request with a code fix and TianoCore members issued a public advisory.

   1. CVE-2026-97631 is a memory-corruption flaw in an ICMP component of TianoCore EDK II and carries a severity score of 9.5 out of 10, Ars Technica reports.
   2. TianoCore EDK II is the open-source UEFI firmware codebase used extensively by independent BIOS vendors AMI, Insyde and Phoenix, and its code was also used in Microsoft's Project Mu hardened fork, according to Ars Technica.
   3. Code run through the flaw executes before Secure Boot and Trusted Platform Module defenses establish the boot chain of trust; delivered payloads have no persistence but can install further payloads that run early on every boot, per Ars Technica.
   4. The flaw was found by two researchers, who arranged for it to stay confidential until a coordinated disclosure scheduled for January, Ars Technica reports.
   5. According to Ars Technica, a pull request from AMI, posted last month, laid out the vulnerability and contained a code fix, and following that, members of the TianoCore Project issued a public advisory.

   Reported by Ars Technica and Techzine Global.

   • Microsoft
   • AMI
   • Project Mu
   • Secure Boot
   • TianoCore EDK II
   • CVE-2026-97631

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.