Today’s Field Note

Apple shipped emergency fixes for CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta and used in what Apple politely calls “extremely sophisticated” targeted attacks. That is the usual language for commercial spyware hitting a short list of high-value phones, so it matters most if you carry journalists, execs, or dissidents on your roster. Meanwhile the boring stuff keeps bleeding: researchers found over 16,000 misconfigured Supabase databases exposing PII, passwords, and auth tokens to anyone who asks. And the MCP Python SDK (fixed in 1.30.0) was shipping client secrets and PKCE keys to attacker-controlled token endpoints, which is the kind of supply-chain footgun that scales as fast as everyone’s rush to bolt agents onto everything.

Today’s Action

  • Push the Apple updates (iOS, iPadOS, macOS) to all managed devices now, and prioritize high-risk users first.
  • Inventory any apps built on the MCP Python SDK and bump to 1.30.0 or later; rotate any OAuth client secrets that may have leaked.
  • Audit your Supabase deployments: enforce Row Level Security, check for publicly readable tables, and rotate exposed service keys.
  • Confirm your MDM can verify the CoreGraphics patch landed rather than just marking it “assigned.”
  • If you have targeted-attack risk (execs, journalists, activists), enable Lockdown Mode on their Apple devices.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the phones, close the buckets, rotate the secrets. Same list, new day.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.