Apple patches 286 flaws, backports exploited CoreGraphics fix to older iPhones

Apple released a wide set of security updates on Monday, October 26, 2026, fixing a total of 286 vulnerabilities across its newest platform versions and extending the fix for an actively exploited CoreGraphics zero-day to older iPhones and iPads, according to SecurityWeek and BleepingComputer. The backported fix arrives in iOS and iPadOS 18.7.11 for devices that cannot upgrade to newer major versions.

What happened

The exploited flaw, CVE-2026-86950, is an out-of-bounds write in CoreGraphics, the framework that handles 2D graphics, text drawing and image rendering. Apple says processing a maliciously crafted file may lead to arbitrary code execution and that it is aware of a report that the flaw was exploited in an 'extremely sophisticated' attack against specific targeted individuals on iOS versions before iOS 27, BleepingComputer reported. Meta Product Security discovered the bug.

Apple first fixed the flaw in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The new backport extends it to the iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later and iPad mini 6th generation and later, according to BleepingComputer. SecurityWeek noted that iOS and macOS 27 do not appear to be affected and that there is no public information about the attacks.

Technical details

According to SecurityWeek, macOS Golden Gate 27.2 addresses 263 vulnerabilities, iOS and iPadOS 27.2 fix 163, iOS and iPadOS 26.7.2 fix 134, macOS Tahoe 26.7.2 fixes 213 and macOS Sequoia 15.8.2 fixes 197. Updates were also released for tvOS, watchOS, visionOS and Safari.

The iOS fixes include many memory corruption bugs in WebKit, the kernel and components that process images, fonts, PDFs and media files, some of which could allow arbitrary code execution, as well as WebContent sandbox escapes and privacy preference bypasses. On macOS, SecurityWeek highlighted more than a dozen privilege escalation flaws that could give apps root access, Gatekeeper bypasses and flaws in Screen Sharing, Remote Management and SMB, including a Remote Management bug that could let a remote attacker execute code.

Who is affected

Owners of older iPhones and iPads that remain on iOS or iPadOS 18 are the main group exposed to the exploited flaw. Users on any platform version older than the 27.2, 26.7.2 or 15.8.2 releases are affected by the newly fixed bugs.

What to do

Apple strongly advises installing the backported patches even though it says the exploited flaw has been used only in highly targeted attacks. Users should update to iOS or iPadOS 18.7.11 on older devices, or to the latest available 27.2, 26.7.2 or 15.8.2 releases. Organizations managing Mac fleets should prioritize the macOS updates, particularly where Screen Sharing or Remote Management is enabled.