Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Apple Patches Actively Exploited Zero Day Allowing Code Execution

Part of the CVE-2026-86950 story · since 28 Sep

Quiet for 2 weekslast report 29 Oct17 articles9 outlets
28 Sep · SANS ISC first23 Oct31 OctNowThis article2nd of 17
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV. This article, 2nd of 17.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SecurityWeek. Apple patches 286 flaws and backports fix for exploited bug. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. Malwarebytes. Apple backports fix for exploited flaw to older iPhones and iPads. Cites a CVE in CISA KEV.

Apple issued emergency security updates on 29 September 2026 for CVE-2026-86950, an actively exploited zero-day vulnerability that can allow arbitrary code execution. The flaw affects iOS and iPadOS versions before 26.7.1, macOS Tahoe before 26.7.1 and macOS Sequoia before 15.8.1. Apple said attackers had used the vulnerability in targeted attacks against specific users running earlier software builds. No public proof-of-concept exploit code has been reported.

The vulnerability is an out-of-bounds write caused by inadequate memory bounds checking. According to Apple, processing a maliciously crafted file can trigger the issue. An attacker could send a specially prepared document, image or media file, which, when processed by an affected application, may corrupt memory and enable arbitrary code execution with the permissions of the vulnerable process. The report gives the vulnerability a CVSSv3 score of 8.8 and maps its impact to CWE-787.

Apple’s updates address the problem through improved bounds checking. Users and administrators should install iOS or iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, as applicable. The article also advises avoiding unexpected files from unknown senders while systems remain unpatched.

How the story developed

All 17 articles
Quiet for 2 weekslast report 29 Oct17 articles9 outlets

17 articles from 9 outlets since 28 Sep. Quiet since 29 Oct. This was the 2nd report, 3 hours after the first.

Now28 Sep23452729First reportSANS ISC · 28 Sep, 23:30CISA alert29 Sep, 15:02 · official
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV. This article, 2nd of 17.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SecurityWeek. Apple patches 286 flaws and backports fix for exploited bug. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. Malwarebytes. Apple backports fix for exploited flaw to older iPhones and iPads. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Mon 28 SepDay 01
    1. Apple Patches Exploited Zero Day Targeting Older iOS Versions23:30 · SANS ISC · First report · Exploited CVE · Known exploited CVE
  2. Tue 29 SepDay 16
    1. Apple Patches Actively Exploited Zero Day Allowing Code Execution02:29 · SecurityOnline · Known exploited CVE · This article, 2nd of 17
    2. Apple Patches iOS Flaw Exploited in Targeted Attacks06:30 · SecurityWeek · Known exploited CVE
    3. CISA Warns of Actively Exploited Apple CoreGraphics Flaw15:02 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 29 Sep
    1. Apple Fixes Exploited iPhone Flaw in Targeted Attacks10:58 · Malwarebytes · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks14:25 · Security Affairs · Known exploited CVE
    3. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks22:00 · Dark Reading · Known exploited CVE
  3. Wed 30 SepDay 23
    1. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs08:25 · Security Affairs · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks09:01 · Infosecurity · Known exploited CVE
    3. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker09:01 · SecurityOnline · Known exploited CVE
  4. Thu 1 OctDay 32
    1. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation07:31 · The Hacker News · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks12:31 · Security Affairs · Known exploited CVE

  5. Quiet for 4 days

    Mon 5 OctDay 71
    1. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk04:06 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 3 weeks

    Tue 27 OctDay 293
    1. Apple fixes 304 flaws, including one exploited in targeted attacks00:30 · SANS ISC · Picked up again · Known exploited CVE
    2. Apple backports exploited CoreGraphics flaw fix to older iPhones04:30 · SecurityOnline · Known exploited CVE
    3. Apple patches 286 flaws and backports fix for exploited bug13:40 · SecurityWeek · Known exploited CVE

  7. Quiet for 2 days

    Thu 29 OctDay 311
    1. Apple backports fix for exploited flaw to older iPhones and iPads12:00 · Malwarebytes · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in