Skip to content
OriginalSign in

SecurityOnlineDo Son

Apple backports exploited CoreGraphics flaw fix to older iPhones

Part of the CVE-2026-86950 story · since 28 Sep

Developinglatest 51 minutes ago15 articles9 outlets
28 Sep · SANS ISC first14 Oct19 OctNowThis article15th of 15
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV. This article, 15th of 15.

Apple has backported a fix for a exploited CoreGraphics zero-day, CVE-2026-86950, to older iPhones and iPads. On 26 October 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 to address the flaw, which Apple says “may have been exploited” against targeted individuals. The advisory notes the issue is an out-of-bounds write that could allow arbitrary code execution when processing a maliciously crafted file, with the highest recorded CVSSv3 score of 8.8.

The patch also appears in other Apple platforms (e.g., macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1) and is intended for devices unable to run newer iOS versions.

The vulnerability, CVE-2026-86950, is already listed in the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalogue as of 29 September 2026, and is described as exploited in the wild for some targeted victims.

In addition to CVE-86950, the article notes two other fixes: CVE-2026-65339 (Audio) could lead to leakage of sensitive user information, and CVE-2026-86990 (CoreMedia) could allow a malicious app to access the camera without user permission; these two were attributed to Mustafa Calap of dbg[.]re, with further acknowledgement to Meta Red Team X for the audio flaw, though Apple states no exploitation was observed for these two.

Affected devices include iPhone XS, XS Max and XR, as well as various iPad generations (including iPad 7th gen, iPad Air 4th gen and later, iPad 9th gen and later, iPad mini 6th gen and later). Practical responses are to install iOS 18.7.11 or iPadOS 18.7.11, and for newer devices to update to iOS 26.7.1 or later; users are advised to avoid opening untrusted image or document files until patched.

How the story developed

All 15 articles
Developinglatest 51 minutes ago15 articles9 outlets

15 articles from 9 outlets since 28 Sep. Picked up again today after 3 weeks quiet. This was the 15th report, 28 days after the first.

Now28 Sep301 Oct2345First reportSANS ISC · 28 Sep, 23:30This article15th of 15 · day 29CISA alert29 Sep, 15:02 · official
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. SecurityOnline. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV. This article, 15th of 15.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Mon 28 SepDay 01
    1. Apple Patches Exploited Zero Day Targeting Older iOS Versions23:30 · SANS ISC · First report · Exploited CVE · Known exploited CVE
  2. Tue 29 SepDay 16
    1. Apple Patches Actively Exploited Zero Day Allowing Code Execution02:29 · SecurityOnline · Known exploited CVE
    2. Apple Patches iOS Flaw Exploited in Targeted Attacks06:30 · SecurityWeek · Known exploited CVE
    3. CISA Warns of Actively Exploited Apple CoreGraphics Flaw15:02 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 29 Sep
    1. Apple Fixes Exploited iPhone Flaw in Targeted Attacks10:58 · Malwarebytes · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks14:25 · Security Affairs · Known exploited CVE
    3. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks22:00 · Dark Reading · Known exploited CVE
  3. Wed 30 SepDay 23
    1. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs08:25 · Security Affairs · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks09:01 · Infosecurity · Known exploited CVE
    3. Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker09:01 · SecurityOnline · Known exploited CVE
  4. Thu 1 OctDay 32
    1. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation07:31 · The Hacker News · Known exploited CVE
    2. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks12:31 · Security Affairs · Known exploited CVE

  5. Quiet for 4 days

    Mon 5 OctDay 71
    1. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk04:06 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 3 weeks

    Tue 27 OctDay 292
    1. Apple fixes 304 flaws, including one exploited in targeted attacks00:30 · SANS ISC · Picked up again · Known exploited CVE
    2. Apple backports exploited CoreGraphics flaw fix to older iPhones04:30 · SecurityOnline · Known exploited CVE · This article, 15th of 15

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in