Older iPhones Get Fix for Exploited Apple Flaw

Owners of an iPhone XS, XS Max or XR should install iOS 18.7.11 now. Apple released the update on 26 October to fix CVE-2026-86950, a flaw in its CoreGraphics image-handling framework that the company says “may have been exploited in an extremely sophisticated attack against specific targeted individuals”. Newer iPhones and Macs received the same fix in September.

The flaw lets a booby-trapped file run code on the device. “Processing a maliciously crafted file may lead to arbitrary code execution,” Apple says in its security notes for iOS 18.7.11 and iPadOS 18.7.11. It describes the bug as “an out-of-bounds write issue” fixed “with improved bounds checking”, and credits Meta Product Security with the report.

In brief

iOS 18.7.11 and iPadOS 18.7.11 bring September’s CoreGraphics fix to the iPhone XS, XS Max and XR and to older iPads, including the iPad 7th generation.
Apple says the flaw may have been used in targeted attacks on versions of iOS before iOS 27. It names no attacker and no targets.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of exploited vulnerabilities on 29 September.
The update also fixes a camera-access flaw and an information leak.

Who needs to update, and how

Apple’s update applies to the iPhone XS, iPhone XS Max and iPhone XR, plus a set of iPads that Apple lists, including the iPad 7th generation. On those devices, open Settings, then General, then Software Update, and install iOS 18.7.11 or iPadOS 18.7.11.

For everyone else, the fix arrived on 28 September. Apple patched CVE-2026-86950 that day in iOS 26.7.1 and iPadOS 26.7.1, listed for the iPhone 11 and later, and in macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, with the same warning about targeted attacks. Anyone on those systems who has not updated since September should do so.

Apple’s latest version of iOS and iPadOS is now 27.2, released on the same day alongside iOS 26.7.2 and new macOS builds, according to its list of security releases. iOS 27.2 also brought the Siri AI beta to five more languages.

The 18.7.11 update fixes two more flaws for older devices. One, CVE-2026-86990 in CoreMedia, could let “a malicious app” access “the camera without user permission”. The other, CVE-2026-65339 in Audio, could let an app “leak sensitive user information”. Apple does not say either was exploited.

Older iPhones waited four weeks for the fix

The backport closes a gap. Apple’s September fix for iOS was listed only for the iPhone 11 and later, so the XS, XS Max and XR, which run the older iOS 18 line, had no patch for 28 days after Apple said the bug may have been exploited.

That gap mattered most for organisations. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 September and gave US federal civilian agencies until 13 October to apply Apple’s fixes or stop using affected products. The catalogue entry pointed only to the September releases, so any agency still running an iPhone XS or XR had no patch to apply by that date. The US National Vulnerability Database lists a severity score of 8.8 out of 10, rated high, from CISA, noting that a user has to open or process the file.

Apple’s wording also limits what is known. It says the attack targeted “specific targeted individuals” on versions of iOS before iOS 27. Apple uses that language for narrow, focused attacks rather than mass campaigns, so most owners are unlikely to have been targets. Owners of older devices still have no way to know if they were targeted, so the update is the only practical step. But Apple names no attacker, no victims and no delivery method, and says it does not discuss security issues until fixes are out. It credits only Meta Product Security for the report.

BleepingComputer counts this as Apple’s second exploited zero-day of 2026, after CVE-2026-20700 in February. CISA’s catalogue lists that earlier flaw as added on 12 February.

Two lessons follow. Older devices still on support can lag behind for weeks when a bug is under attack, so owners should keep automatic updates on. And security teams tracking catalogue deadlines, as with the Arista VeloCloud zero-day and the PHP2Shell flaws, should check whether each device type actually has a patch. Exploit chains for current iPhones also keep appearing, as Calif showed with an iOS 27.0.1 jailbreak at Hexacon this month; nothing links that work to this flaw.