Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.
Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad.
The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to an older one. Here, Apple has made the fix available to older devices running iOS 18, so they can be protected without upgrading to an operating system they don’t support.
Updates for your particular device
The table below shows which updates are available and links to Apple’s security information for each one.
| Name and information link | Available for |
| iOS 27.2 and iPadOS 27.2 | iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later |
| iOS 26.7.2 and iPadOS 26.7.2 | iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later |
| iOS 18.7.11 and iPadOS 18.7.11 | iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation |
| macOS Golden Gate 27.2 | macOS Golden Gate |
| macOS Tahoe 26.7.2 | macOS Tahoe |
| macOS Sequoia 15.8.2 | macOS Sequoia |
| tvOS 27.2 | Apple TV 4K 2nd generation and later |
| watchOS 27.2 | Apple Watch Series 9 and later |
| visionOS 27.2 | Apple Vision Pro (all models) |
| Safari 27.2 | macOS Sequoia and macOS Tahoe |
| tvOS 26.6.1 (no published CVE entries) | Apple TV HD and Apple TV 4K 1st generation |
How to update your Apple devices
How to update your iPhone or iPad
For iOS and iPadOS users, here’s how to check if you’re using the latest software version:
Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.
Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.
How to update your Mac
To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:
- Click the Apple menu in the upper-left corner of your screen.
- Choose System Settings (or System Preferences on older versions).
- Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
- Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
- Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
- Keep your Mac plugged in and connected to the internet until the update is done.
How to update your Safari browser
Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:
- Open the Apple menu > System Settings > General > Software Update.
- If you see a Safari update listed separately, click Update Now to install it.
- Restart your device when prompted.
Technical details
The headline bug is CVE-2026-86950, in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The result is that “processing a maliciously crafted file may lead to arbitrary code execution.”
Apple says it is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27.
That wording indicates Apple believes the bug was used in real attacks against a limited group of users.
Usually, journalists, activists and officials are the targets of this kind of attack. If you think you could be a target of highly sophisticated spyware, you should update, restart your phone, and consider applying Apple’s Lockdown Mode.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.