Back

Apple Releases Security Fixes for iPhones and iPads

lite News Desk 1 min read

Apple’s iOS 18.7.11 and iPadOS 18.7.11 updates, released on October 26, 2026, include a fix for a CoreGraphics vulnerability linked to a report of possible targeted exploitation, according to the company’s security advisory. The releases also contain corrections for Audio and CoreMedia.

For the CoreGraphics vulnerability, identified as CVE-2026-86950, Apple said it had received a report of possible use in an attack targeting specific individuals whose devices ran iOS releases earlier than iOS 27. The company described the reported attack as extremely sophisticated. Its advisory does not confirm that the attack occurred.

Apple describes the technical problem as an out-of-bounds write. According to the advisory, processing a file crafted for malicious purposes may allow arbitrary code to execute. Apple said it corrected the flaw by improving bounds checking, and the advisory names Meta Product Security as the organisation that reported it.

The advisory lists three iPhone models as eligible for the security fixes: iPhone XS Max, iPhone XR and iPhone XS. For iPads, Apple lists the seventh-generation iPad, along with the ninth-generation iPad and subsequent generations. Availability also covers iPad Air models from the fourth generation onward and iPad mini models starting with the sixth generation.

The CoreGraphics issue was also listed in Apple’s September 28, 2026, releases of iOS 26.7.1 and iPadOS 26.7.1. Those updates carried the same qualified account of possible exploitation against selected targets, rather than confirmation that an attack had taken place.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. The flaw affects Brotli data processed by Node.js’s zlib module, with crashes, memory disclosure or code execution possible for attacker-supplied input.

  2. A cyber incident impacted services in Neshoba County, with email and website disruptions reported, according to company updates.

  3. A cyberattack began on 13 October 2026, targeting over 100 Azerbaijani state domains, disrupting government online resources, according to CERT.

  4. Regulators are increasing scrutiny on AI risks in banking. Compliance deadlines for cyber threats are set for October 2026, according to reports.

  5. Ahold Delhaize has taken IT systems offline due to a cybersecurity incident, disrupting services for brands including Albert Heijn and Food Lion.