, front page
InitialReach
How we report

SecurityApple security updatesChanged

iPhone XS and XR get a fix for a possibly exploited flaw four weeks after newer iPhones, Apple's notes show

Apple released updates for iOS 27, iOS 26 and iOS 18 on 26 October. For the iPhone XS, XS Max and XR, iOS 18.7.11 fixes a flaw in CoreGraphics that Apple says “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”

iPhones running iOS 26 got the same fix four weeks earlier, in iOS 26.7.1 on 28 September, with the same warning. iOS 27.2, the main update for the iPhone 11 and later, fixes 163 vulnerabilities according to Apple's security notes, none of them marked as exploited.

The possibly exploited flaw, on iPhone XS, XS Max and XR

Before: Not fixedNow: Fixed in iOS 18.7.11

What changed

  1. iPhone 11 and later, on iOS 27

    Before

    iOS 27.0.1, from 28 September

    Now

    iOS 27.2: fixes for 163 vulnerabilities, none marked as exploited

  2. iPhone 11 and later, staying on iOS 26

    Before

    iOS 26.7.1, from 28 September

    Now

    iOS 26.7.2: fixes for 134 vulnerabilities, none marked as exploited

  3. iPhone XS, XS Max and XR, and iPad 7th generation

    Before

    iOS 18.7.10, from 17 August

    Now

    iOS 18.7.11: fixes for 3 vulnerabilities, including the CoreGraphics flaw Apple says may have been exploited

  4. The CoreGraphics flaw (CVE-2026-86950)

    Before

    Fixed on iOS 26 in iOS 26.7.1 on 28 September; not yet fixed on iOS 18

    Now

    Also fixed on iOS 18, in iOS 18.7.11

What stayed the same

  • iPhone 11 and later can stay on iOS 26 instead of moving to iOS 27: both lines got an update on the same day.
  • The iPhone XS, XS Max and XR stay on iOS 18. Apple's update for them lists the same models as the one in August.

What we don't know yet

  • Who was targeted, and how. Apple says only that the attack was “extremely sophisticated” and against “specific targeted individuals”.
  • Why the fix reached iOS 18 four weeks after iOS 26.
  • What iOS 27.2 changes besides security. This entry covers Apple's security notes; we have not yet read Apple's notes on new features.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
Identifier
CVE-2026-86950, CoreGraphics. Credited to Meta Product Security.
Impact
“Processing a maliciously crafted file may lead to arbitrary code execution.”
Bug class
Out-of-bounds write, “addressed with improved bounds checking.”
Exploitation
Apple is “aware of a report” that it “may have been exploited” against specific targeted individuals, on versions before iOS 27. Apple's iOS 27 notes do not list it.
Fixed in
iOS and iPadOS 26.7.1, 28 September. iOS and iPadOS 18.7.11, 26 October.
Backport gap
28 days as an n-day on the iOS 18 branch: listed with its fix in Apple's 26.7.1 notes on 28 September, fixed for iOS 18 on 26 October.
Patch volume, 26 October
iOS 27.2, 163 CVEs; iOS 26.7.2, 134; iOS 18.7.11, 3. CVE-2026-86950 is the only one Apple flags as possibly exploited.