Good morning. Two stories today, both about trust you did not know you were giving.
The flaw that lived in Apple's loader for twenty years
CVE-2026-20700 is a memory corruption bug in dyld, Apple's Dynamic Link Editor, the component that loads every application's code on iOS and macOS. It has been there for nearly two decades. Google's Threat Analysis Group found it being used in "extremely sophisticated attacks against specific targeted individuals," chained with two WebKit zero-days from December 2025 (CVE-2025-14174 and CVE-2025-43529). It is Apple's first actively exploited zero-day of 2026, and it is in CISA's KEV catalog. An attacker who already has memory write capability can use this flaw for arbitrary code execution at the deepest layer of the operating system, below the sandbox.
What to do: update to iOS 26.3, macOS Tahoe 26.3, or the matching legacy releases (iOS 18.7.5, Sequoia 15.7.4, Sonoma 14.8.4). If a high-value target also skipped the December 2025 patches, treat the device as potentially compromised.
Canva's vendor handed attackers the Salesforce keys
Canva confirmed that enterprise customer records were exposed after attackers compromised Canny, a third-party feedback tool with a standing connection into Canva's Salesforce. Business contacts and contract documents were exposed. The group calling itself The Seven Deadly Sins claims it spent over 72 hours inside Canva's Salesforce and already sold the data to a "private buyer." The claimed volumes are unverified, but Canva's confirmation is not: access was revoked and affected customers were notified. Canva says its own platform, accounts, passwords, and designs were not touched.
What to do: inventory every third-party app with persistent access to your CRM and remove standing grants you do not use. Then watch for invoice and renewal scams built from the real order documents now in criminal hands, because those scams will look legitimate.
Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com