Apple has pushed its fix for an actively exploited graphics flaw to older iPhones that could not take last month's emergency update. iOS 18.7.11 and iPadOS 18.7.11, released on October 26, patch CVE-2026-86950, the CoreGraphics bug Apple first fixed on September 28 after receiving a report that it had been used in attacks.
The update is part of a broad Apple release day that also delivered iOS 27.2, iOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, tvOS 27.2, watchOS 27.2 and visionOS 27.2. Hong Kong's HKCERT, which consolidated the releases in a bulletin on October 27, lists 329 CVE identifiers across them.
A four-week gap for the iPhone XS and XR
When Apple first fixed CVE-2026-86950, the iOS 26.7.1 update covered the iPhone 11 and later. Apple's notes for iOS 18.7.11 list the iPhone XS, iPhone XS Max and iPhone XR, plus several older iPad models, as the devices this release is for. Those phones did not appear on the September list, so they have waited four weeks for the same fix. We covered the original patch in Apple fixes iPhone and Mac zero-day used in targeted attacks.
Apple's wording on the flaw is unchanged: processing a maliciously crafted file may lead to arbitrary code execution, and Apple is aware of a report that the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Apple describes it as an out-of-bounds write, meaning software writing data past the end of the memory it was given, fixed with improved bounds checking. The bug was reported by Meta Product Security. CISA added it to its Known Exploited Vulnerabilities catalog on September 29, and NVD scores it 8.8.
Two more fixes ride along for older devices
iOS 18.7.11 carries two further fixes, neither of which Apple flags as exploited and neither of which has a published CVSS score:
- CVE-2026-65339 (Audio): an app may be able to leak sensitive user information. Apple calls it a logic issue. Credited to Mustafa Calap and Nik Tsytsarkin of Meta Red Team X.
- CVE-2026-86990 (CoreMedia): a malicious app may be able to access the camera without user permission. Apple calls it an access issue. Credited to Mustafa Calap.
A big release everywhere else, with no new zero-days flagged
The rest of the October 26 wave is much larger. The iOS 27.2 notes alone list more than 150 CVE entries, and the macOS Golden Gate 27.2 notes more than 250. HKCERT summarises the possible impact as denial of service, elevation of privilege, security restriction bypass, information disclosure and remote code execution, and rates its bulletin Medium Risk. Of the ten Apple advisories, only the iOS 18.7.11 notes carry Apple's exploitation language, and that entry is the September bug. The full per-component detail is in Apple's own advisories, starting with the iOS 27.2 notes.
Update to iOS 18.7.11, 26.7.2 or 27.2 now
Owners of an iPhone XS, XS Max or XR should install iOS 18.7.11 from Settings, General, Software Update. Everyone else should move to the latest release their device supports: iOS 27.2 or iOS 26.7.2 on phones and tablets, and macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2 on Macs, along with Safari 27.2 where it ships separately. Organisations with managed fleets should check specifically for devices stuck on iOS 18, which until this week had no fix for a bug already used in the wild.
Apple's handling here follows a familiar pattern: the newest devices get the fix first, and older hardware follows weeks later. For anyone protecting high-risk users on older iPhones, that gap is the window that matters most.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.