Apple fixed 286 flaws and an exploited bug on older iPhones. Push the updates to every phone and Mac

Apple’s Monday updates fix 286 security flaws across iOS and macOS 27.2, and they bring the fix for a CoreGraphics bug used in targeted attacks to iPhones that cannot run anything newer than iOS 18.

If your company hands out iPhones or lets staff read work email on their own, the older phones are the ones to chase.

Apple’s exploited CoreGraphics fix finally reached the iPhone XS, XS Max and XR on Monday. Those phones top out at iOS 18, so iOS 18.7.11 is the only way to close it.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Apple fixed 286 flaws and backported an exploited bug to iOS 18

On October 26 Apple released iOS and iPadOS 27.2, macOS Golden Gate 27.2, iOS and iPadOS 26.7.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, and iOS and iPadOS 18.7.11. SecurityWeek counts 263 fixes in macOS Golden Gate 27.2 and 163 in iOS 27.2, about 140 of them shared, for 286 in total.

iOS 18.7.11 fixes three bugs, including CVE-2026-86950, an out-of-bounds write in CoreGraphics that Meta’s product security team found. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Apple first fixed it on September 28 in iOS 26.7.1 and macOS Tahoe 26.7.1; this release covers the iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation.

Older iPhones and iPads that stopped at iOS 18

Apple says processing a crafted file is enough to trigger CVE-2026-86950. It describes the attacks as aimed at specific people, but the fix for newer iPhones has been public since September 28, which gives other attackers a month to compare patched and unpatched code.

The 27.2 releases cover more ground. SecurityWeek says macOS Golden Gate 27.2 fixes more than a dozen ways for an app to gain root, plus flaws in Screen Sharing, Remote Management and SMB that can be reached over the network, including a Remote Management bug that could let a remote attacker run code.

Set the 27.2, 26.7.2 and 18.7.11 minimums in device management

• In your device management tool, set minimum versions of iOS 27.2, iOS 26.7.2 or iOS 18.7.11 depending on what each model can run, and block work email on anything older.
• Find the iPhone XS, XS Max, XR and iPad 7th generation units in your inventory first; they get no further major releases.
• Update Macs to macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2, starting with machines that have Screen Sharing or Remote Management turned on.
• Update Safari to 27.2 on Macs that stay on Sequoia or Tahoe.

Details

• Exploited: CVE-2026-86950 (CoreGraphics, out-of-bounds write), fixed in iOS and iPadOS 18.7.11, 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. iOS and macOS 27 are not listed as affected.
• Also in iOS 18.7.11: CVE-2026-65339 (Audio, an app may leak sensitive user information) and a CoreMedia fix for apps reaching the camera without permission.
• Counts (SecurityWeek): iOS 26.7.2, 134 fixes; macOS Tahoe 26.7.2, 213; macOS Sequoia 15.8.2, 197; tvOS 27.2, 72; watchOS 27.2, 62; visionOS 27.2, 125; Safari 27.2, 33.

Hunt / verify

• Pull a report of iOS and iPadOS versions from your device management tool and sort by model, so the iOS 18 devices stand out.
• On Macs, run sw_vers to confirm the build, and check System Settings for Screen Sharing and Remote Management on machines that do not need them.
• Apple has not published indicators for the CoreGraphics attacks, so the useful check is the version number.

Source: Apple security releases

Sources

• Apple: Apple security releases
• Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11
• Apple: About the security content of iOS 27.2 and iPadOS 27.2
• Apple: About the security content of macOS Golden Gate 27.2
• SecurityWeek: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
• BleepingComputer: Apple backports CoreGraphics zero-day patches to older iPhones

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].