Skip to content
OriginalSign in

SANS ISC

Apple fixes 304 flaws, including one exploited in targeted attacks

Part of the CVE-2026-86950 story · since 28 Sep

Developinglatest 1 hour ago14 articles9 outlets
28 Sep · SANS ISC first14 Oct19 OctNowThis article14th of 14
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV. This article, 14th of 14.

Apple has rolled October 2026 patches that addresses 304 vulnerabilities across its platforms, a figure in line with prior updates and following a patch cycle about a month after the previous release.

The bulletin identifies a notable issue, CVE-2026-86950, described as a maliciously crafted file issue in CoreGraphics that Apple says may have been exploited in an extremely sophisticated attack against targeted individuals on older iOS versions; the October update provides corresponding fixes for iOS 18-era builds and iOS 27-era devices.

The changelist also notes CVEs such as CVE-2026-86990 (camera access without user permission) and CVE-2026-28864 (local attack to access Keychain items), among many others across multiple components.

The affected products and versions span iOS 27.2 and iPadOS 27.2; iOS 26.7.2 and iPadOS 26.7.2; iOS 18.7.11; macOS Golden Gate 27.2; macOS Tahoe 26.7.2; macOS Sequoia 15.8.2; tvOS 27.2; watchOS 27.2; visionOS 27.2; Safari 27.2.

The CVE-by-CVE table also lists many flaws across core systems and apps, including CVE-2026-112410 (remote termination via Heimdal), CVE-2026-112414 (mail), CVE-2026-112424 (kernel memory read), CVE-2026-112429 (ColorSync), CVE-2026-112455 (AppleAVD), CVE-2026-112468 (AV EVideoEncoder), CVE-2026-112470 (AV EVideoEncoder), CVE-2026-112492 (StorageKit), CVE-2026-112507 (Kernel termination), and CVE-2026-112557 (Spotlight) among many others.

The list demonstrates the breadth of affected subsystems, from CoreGraphics and WebKit to kernel, device drivers and security controls. The update includes fixes for both privilege-escalation and information-disclosure risks, as well as several memory-corruption and denial-of-service scenarios.

No additional vulnerabilities are flagged as already exploited beyond CVE-2026-86950, according to the disclosure. The publication attributes each item to the corresponding researcher, vendor or vendor advisory, and presents the patch contents as the official response. The article does not provide user guidance beyond listing the patched CVEs and affected products. SOURCE_UNAVAILABLE

How the story developed

All 14 articles
Developinglatest 1 hour ago14 articles9 outlets

14 articles from 9 outlets since 28 Sep. Picked up again today after 3 weeks quiet. This was the 14th report, 28 days after the first.

Now28 Sep301 Oct2345First reportSANS ISC · 28 Sep, 23:30This article14th of 14 · day 29CISA alert29 Sep, 15:02 · official
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV. This article, 14th of 14.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Mon 28 SepDay 01
    1. Apple Patches Exploited Zero Day Targeting Older iOS Versions23:30 · SANS ISC · First report · Exploited CVE · Known exploited CVE
  2. Tue 29 SepDay 16
    1. Apple Patches Actively Exploited Zero Day Allowing Code Execution02:29 · SecurityOnline · Known exploited CVE
    2. Apple Patches iOS Flaw Exploited in Targeted Attacks06:30 · SecurityWeek · Known exploited CVE
    3. CISA Warns of Actively Exploited Apple CoreGraphics Flaw15:02 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 29 Sep
    1. Apple Fixes Exploited iPhone Flaw in Targeted Attacks10:58 · Malwarebytes · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks14:25 · Security Affairs · Known exploited CVE
    3. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks22:00 · Dark Reading · Known exploited CVE
  3. Wed 30 SepDay 23
    1. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs08:25 · Security Affairs · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks09:01 · Infosecurity · Known exploited CVE
    3. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker09:01 · SecurityOnline · Known exploited CVE
  4. Thu 1 OctDay 32
    1. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation07:31 · The Hacker News · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks12:31 · Security Affairs · Known exploited CVE

  5. Quiet for 4 days

    Mon 5 OctDay 71
    1. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk04:06 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 3 weeks

    Tue 27 OctDay 291
    1. Apple fixes 304 flaws, including one exploited in targeted attacks00:30 · SANS ISC · Picked up again · Known exploited CVE · This article, 14th of 14

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in