If you still use an iPhone XS, XS Max or XR, or a seventh-generation iPad, there is an important update waiting for you. On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11, bringing a fix for a flaw that Apple says may have been used in an “extremely sophisticated attack” to devices that can’t run the newest iOS.1, 2
Reporting checked October 27, 2026.
Too long; didn’t read?
- The flaw, CVE-2026-86950, is in CoreGraphics, the part of iOS that draws text and images. A booby-trapped file could run an attacker’s code.1
- Newer iPhones got the fix in September; older ones only get it now.2, 3
- Apple released updates for almost all its devices on the same day, so everyone should check for updates.2
- Go to Settings > General > Software Update.5
What the flaw is
Apple’s security notes say that “processing a maliciously crafted file may lead to arbitrary code execution”, which means a specially prepared file could make your device run instructions chosen by an attacker. Apple adds that it is aware of a report that the flaw may have been exploited “against specific targeted individuals on versions of iOS before iOS 27”. The bug was reported by Meta’s product security team.1
Security firm Calif, which analysed the fix, wrote that a PDF containing a specially crafted font can trigger the bug while the document is being displayed. Its public demonstration only crashes the device; it does not show how to take control of it.4
The US cybersecurity agency CISA added the flaw to its list of actively exploited vulnerabilities on September 29, according to Canada’s Centre for Cyber Security.6
The same update also fixes two other bugs: one that could let a malicious app use the camera without your permission, and one that could let an app leak sensitive information.1
“Targeted attacks” still concern you
Attacks like this are usually aimed at a small number of people, such as journalists, activists or officials. But once a fix is public, other people can study it, as Calif did within days. That is why it pays to install these updates even if you don’t think anyone would single you out.
Why older iPhones get a separate update
Apple fixed the flaw for current devices on September 28, in iOS and iPadOS 26.7.1 and in macOS updates.2, 3 The iPhone XS, XS Max, XR and seventh-generation iPad can’t run iOS 26 or 27, so Apple brought the fix back to their older iOS 18 line. That is called a backport.2
The same day, Apple also released iOS and iPadOS 27.2 and 26.7.2, macOS updates and updates for Apple TV, Apple Watch and Vision Pro.2
What you can do
- Update now. Open Settings > General > Software Update and install what is offered. Apple suggests backing up first and plugging in to power and Wi-Fi.5
- Know which version to look for. iPhone XS, XS Max, XR and iPad (7th generation): iOS or iPadOS 18.7.11. Newer devices: 27.2, or 26.7.2 if you have stayed on iOS 26.2
- Turn on automatic updates. Under Software Update > Automatic Updates, your device can install updates overnight while charging on Wi-Fi.5
- Check family members’ phones. Older iPhones are often handed down to parents or children, and they are the ones that need this particular update.
- At higher risk? If you have reason to believe you are personally targeted, Apple recommends Lockdown Mode, which you’ll find under Settings > Privacy & Security. It blocks some features to reduce the ways an attacker can get in.7
Sources
- Apple, October 26, 2026: About the security content of iOS 18.7.11 and iPadOS 18.7.11
- Apple: Apple security releases (entries for September 28 and October 26, 2026)
- BleepingComputer, September 29, 2026: Apple patches CoreGraphics zero-day flaw exploited in attacks
- Calif, September 30, 2026: CVE-2026-86950: The great glyph grift
- Apple: Update your iPhone or iPad
- Canadian Centre for Cyber Security, September 29, 2026: Apple security advisory (AV26-971)
- Apple: About Lockdown Mode
