Cyber news, week of October 26, 2026

Machine summary Cydome, ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime launched Blue Initiative, a free vulnerability database for maritime IT and OT systems. At the time of the SecurityWeek report the index held nearly 30,000 entries, including more than 2,000 with critical CVSS ratings, more than 580 recorded as exploited in attacks, and 37 affecting products built specifically for ships and ports. Most entries are automatically drawn from CISA ICS advisories and the KEV catalog and mapped to maritime systems, with contributions reviewed by Cydome researchers and partners.

1. The database contained nearly 30,000 entries at the time of the SecurityWeek report, with more than 2,000 rated critical based on CVSS score.
2. Most entries are assembled automatically from CISA ICS advisories and the Known Exploited Vulnerabilities catalog and then mapped to maritime systems.
3. The site is free to access; users can browse, search, filter and subscribe to alerts, and community contributions are reviewed by Cydome researchers and partners.
4. Cydome CEO Nir Ayalon said the aim is "a public and open single source of truth for maritime-related vulnerabilities."

Reported by Infosecurity Magazine and securityweek.com.

• CISA
• Bureau Veritas
• CVSS
• MTS-ISAC
• ClassNK
• Cydome

Machine summary DreamHost began resetting passwords for some email and FTP/SFTP users after an issue that began with File Manager connectivity problems on October 23 and expanded to webmail. DreamHost said it deployed a fix and restored access to files.dreamhost.com, but has not disclosed the number of affected users or the root cause.

1. According to BleepingComputer, which cited the company's page, DreamHost states that its customer base exceeds 400,000 across more than 100 countries and that it hosts at least 1.5 million websites and applications, among them 750,000 WordPress installs.
2. DreamHost told account owners it would not request password resets via email and that only account owners can set new credentials for mailbox and FTP users.

Reported by bleepingcomputer.com and securityweek.com.

• WordPress
• DreamHost
• FTP/SFTP

The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

Reported by bleepingcomputer.com.

• University of Copenhagen

Reported by dev.ua, PC Gamer, GamesRadar+, Kotaku, GamingOnLinux, Shacknews, and 10 more outlets.

• Warhorse Studios
• Kingdom Come: Deliverance 2

Full coverage: every report, when each was published, and who was named (16 outlets)

Machine summary Apple shipped iOS and iPadOS 18.7.11 on Monday with a backported fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics that the company said may have been used in extremely sophisticated attacks against targeted individuals on iOS versions before iOS 27. Meta's product security team reported the flaw, which Apple first patched in late September in iOS 26.7.1 and related releases.

1. Apple's Monday updates address 286 vulnerabilities in total, with macOS Golden Gate 27.2 resolving 263 and iOS/iPadOS 27.2 fixing 163, about 140 of them shared (SecurityWeek).
2. iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta's product security team (SecurityWeek, BleepingComputer).
3. Apple initially addressed CVE-2026-86950 at the end of September through iOS 26.7.1 and iPadOS 26.7.1, alongside macOS Tahoe 26.7.1 as well as macOS Sequoia 15.8.1; SecurityWeek reports that iOS and macOS 27 apparently are not affected.
4. iOS and iPadOS 26.7.2 fix 134 vulnerabilities, and the 27.2 updates include WebKit, kernel and media-parsing memory corruption bugs, WebContent sandbox escapes and a Kerberos KDC impersonation issue (SecurityWeek).
5. BleepingComputer reports Apple has now patched two zero-days exploited in attacks this year, the second being CVE-2026-20700 in dyld, fixed in February.

Reported by bleepingcomputer.com and securityweek.com.

• Meta
• Apple
• CoreGraphics
• dyld
• CVE-2026-86950
• CVE-2026-20700

Machine summary Cohesity announced on October 27, 2026 that HashiCorp, an IBM company, validated interoperability between Cohesity Data Cloud's cloud rebuild capability and Terraform Self-Managed. The company describes a recovery flow in which approved infrastructure-as-code recreates the declared configuration and backup restores the latest usable application data.

1. Cohesity announced on October 27, 2026 that HashiCorp, an IBM company, validated interoperability of Cohesity Data Cloud's cloud rebuild capability with Terraform Self-Managed (Cohesity announcement).
2. Per the announcement, IBM has validated this as the first cloud recovery technique achieving interoperability with Terraform Self-Managed, a self-hosted system for declaring and administering cloud infrastructure through code.
3. As the company outlines it, Terraform rebuilds the declared configuration using infrastructure-as-code files that were reviewed and approved, while Cohesity Data Cloud restores the newest usable application data from backup.
4. Cohesity states the combined process returns an application to a trusted state rather than to a production copy that may already contain an attacker's changes.
5. The same survey found 3% of respondents said their recovery plans are ready today; cloud rebuild is stated to be part of Cohesity Data Cloud Enterprise Edition.

Reported by Securitybrief Australia and Pr Newswire.

• IBM
• Cohesity
• Terraform Self-Managed
• Cohesity Data Cloud Enterprise Edition
• Cohesity Data Cloud
• HashiCorp