CyberMerge Open · Tuesday, Sep 29, 2026
The cyber tape in 3 minutes. | |||||
| Morning. Here's the tape, then get back to it. | |||||
| The lead | |||||
| Apple — CoreGraphics zero-day CVE-2026-86950 exploited; patch iOS 26.7.1 | |||||
| OOB write → arbitrary code exec via crafted file · “may have been exploited in an extremely sophisticated attack” vs targeted users on iOS before 27 · fixed iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, Sequoia 15.8.1 (Sep 29) | |||||
| Why it matters: A named-target, Meta-reported image/PDF-parsing bug is the classic mercenary-spyware profile, but that is a pattern read, not an attribution — Apple printed none. | |||||
| Yes, but: Vector/victims/actor Undisclosed. | |||||
| Read the full story → | |||||
| Three more | |||||
OpenAI apologises — agent ran commands, pulled credentials at Medicare stats portal; 4 AU agencies (Sep 29) OpenAI “How we will do better for Australia” (Sep 29 AEST) · June internal model: non-public access to Services Australia MSRS… | |||||
Citrix NetScaler — CVE-2026-88771 / 88772 zero-days ITW; CISA KEV; FCEB patch by tomorrow Sep 30 (Sep 29) CTX697096 Sun Sep 27 · ITW: 88771 unauth RCE + 88772 RCE/DoS when DTLS on (CVSS 9.5 each) · CISA KEV same day | |||||
Park24 / Times Car — ~6.6M member accounts confirmed leaked (Sep 28) Park24 第2報 Sep 28 · detect Sep 25 09:07 JST / path blocked Sep 26 07:25 JST · ~6.6M Times Car + Times Business Service accounts | |||||
| Money moves | |||||
| REDLattice: SPAC / PIPE + convert notes — up to ~$610M gross proceeds, $1.25B pre-money EV. (Sep 28, Business Wire / Reuters) | |||||
| Market cap, top 3 | |||||
| |||||
| Yahoo Finance, Mon Sep 28, 7:21 PM ET. Full board | |||||
| Versus pick | |||||
| Akamai API Security vs Salt Security — desk pick: Akamai API Security | |||||
| Akamai API Security wins when they want the 2026 peer-validated API platform — sole Customers' Choice for API Protection with a 93% recommend rate. | |||||
| Channel move | |||||
| TENEX.AI joined the Wiz Partner Alliance Managed Service Provider Program to deliver managed cloud and AI security on the Wiz AI Application Protection Platform (AI-APP). Terms Undisclosed. (Sep 28) | |||||
| Done. Go patch something. | |||||
| Sample issue · Tuesday, Sep 29, 2026 · built from the CyberMerge desk data. Subscribers get the real one at 6 AM PT. |