Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

Apple backports fix for exploited flaw to older iPhones and iPads

Part of the CVE-2026-86950 story · since 28 Sep

Developinglatest 24 minutes ago17 articles9 outlets
28 Sep · SANS ISC first17 Oct23 OctNowThis article17th of 17
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SecurityWeek. Apple patches 286 flaws and backports fix for exploited bug. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. Malwarebytes. Apple backports fix for exploited flaw to older iPhones and iPads. Cites a CVE in CISA KEV. This article, 17th of 17.

Apple has pushed security updates to address a CoreGraphics flaw that researchers say may have been used in targeted intrusions. The update package, released on 26 October, includes a backport of the fix from newer iOS versions to older devices that cannot run iOS 26, bringing protection to models such as the iPhone XS, iPhone XS Max, iPhone XR, and the 7th-generation iPad.

The backported release is labelled iOS 18.7.11 and iPadOS 18.7.11, with additional updates covering iOS 27.2 and iPadOS 27.2 for newer devices, and other supported macOS, tvOS, watchOS, and visionOS versions.

The technical flaw is CVE-2026-86950, an out-of-bounds write in Apple's CoreGraphics framework that could allow arbitrary code execution when processing a malicious file. Apple notes there is a report suggesting the vulnerability was exploited in an “extremely sophisticated attack against specific targeted individuals” on iOS versions prior to iOS 27, indicating real-world exploitation in a limited scope.

The article states the new fixes are available for older devices running iOS 18, allowing them to be protected without a full OS upgrade. For users who may be targets of high‑level spyware, the piece mentions enabling Apple’s Lockdown Mode as a potential precaution, subject to the source’s guidance. The article also provides device-by-device update mappings and step-by-step instructions for applying updates across iPhone, iPad, Mac, Safari and related platforms.

How the story developed

All 17 articles
Developinglatest 24 minutes ago17 articles9 outlets

17 articles from 9 outlets since 28 Sep. Still developing; the latest report was 24 minutes ago. This was the 17th report, 31 days after the first.

Now28 Sep1 Oct23452728First reportSANS ISC · 28 Sep, 23:30This article17th of 17 · day 31CISA alert29 Sep, 15:02 · official
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SecurityWeek. Apple patches 286 flaws and backports fix for exploited bug. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. Malwarebytes. Apple backports fix for exploited flaw to older iPhones and iPads. Cites a CVE in CISA KEV. This article, 17th of 17.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Mon 28 SepDay 01
    1. Apple Patches Exploited Zero Day Targeting Older iOS Versions23:30 · SANS ISC · First report · Exploited CVE · Known exploited CVE
  2. Tue 29 SepDay 16
    1. Apple Patches Actively Exploited Zero Day Allowing Code Execution02:29 · SecurityOnline · Known exploited CVE
    2. Apple Patches iOS Flaw Exploited in Targeted Attacks06:30 · SecurityWeek · Known exploited CVE
    3. CISA Warns of Actively Exploited Apple CoreGraphics Flaw15:02 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 29 Sep
    1. Apple Fixes Exploited iPhone Flaw in Targeted Attacks10:58 · Malwarebytes · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks14:25 · Security Affairs · Known exploited CVE
    3. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks22:00 · Dark Reading · Known exploited CVE
  3. Wed 30 SepDay 23
    1. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs08:25 · Security Affairs · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks09:01 · Infosecurity · Known exploited CVE
    3. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker09:01 · SecurityOnline · Known exploited CVE
  4. Thu 1 OctDay 32
    1. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation07:31 · The Hacker News · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks12:31 · Security Affairs · Known exploited CVE

  5. Quiet for 4 days

    Mon 5 OctDay 71
    1. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk04:06 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 3 weeks

    Tue 27 OctDay 293
    1. Apple fixes 304 flaws, including one exploited in targeted attacks00:30 · SANS ISC · Picked up again · Known exploited CVE
    2. Apple backports exploited CoreGraphics flaw fix to older iPhones04:30 · SecurityOnline · Known exploited CVE
    3. Apple patches 286 flaws and backports fix for exploited bug13:40 · SecurityWeek · Known exploited CVE

  7. Quiet for 2 days

    Thu 29 OctDay 311
    1. Apple backports fix for exploited flaw to older iPhones and iPads12:00 · Malwarebytes · Known exploited CVE · This article, 17th of 17

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in