Photo: Sara Kurfeß on Unsplash
Apple fixes an exploited flaw on older iPhones and iPads too
In short: Apple released security updates on 26 October that fix a flaw in CoreGraphics, the part of iOS that draws images and PDFs. A booby-trapped file could let an attacker run code on the device, and Apple says it may have been used in highly targeted attacks. Unusually, the fix also reaches older phones such as the iPhone XS and XR through iOS 18.7.11.
What happened
On 26 October Apple released a set of security updates for iPhone, iPad, Mac and its other devices. The most important fix is for CVE-2026-86950, a flaw in CoreGraphics, the part of Apple's software that draws pictures, graphics and PDF files on screen.
Apple says that processing a maliciously crafted file could lead to arbitrary code execution: in plain words, a booby-trapped image or document could let an attacker run their own instructions on your device. Apple says it is aware of a report that the flaw may have been used in an "extremely sophisticated attack against specific targeted individuals". That points to spyware aimed at a small number of people, not a mass attack, but once a fix is public, other criminals study it too.
Good news for older devices
Apple usually saves new fixes for its latest software. This time it also backported the fix to devices that cannot run the newest version:
| Your device | Update to install |
|---|---|
| Newest iPhones and iPads | iOS / iPadOS 27.2 |
| iPhone 11 and later, several older iPads (if you stay on iOS 26) | iOS / iPadOS 26.7.2 |
| iPhone XS, XS Max, XR and iPad (7th generation) | iOS / iPadOS 18.7.11 |
Apple also released updates for Macs, Apple Watch, Apple TV, Vision Pro and the Safari browser.
What it means for you
If you have an iPhone or iPad, install the update today. You do not need to do anything else: there is no setting to change and no app to delete. This is exactly why keeping your devices updated is the single most useful security habit. If your phone is too old to receive any updates at all, it is time to plan a replacement, as our guide to setting up a new phone safely explains.
How to update in one minute
- Open Settings > General > Software Update.
- Tap Update Now (or Download and Install) and keep the phone on charge.
- Turn on Automatic Updates on the same screen so future fixes install overnight.
- On a Mac, go to System Settings > General > Software Update.
- If you are a journalist, activist or in a similar high-risk role, restart your phone after updating and consider turning on Lockdown Mode.
Key takeaways
- Apple fixed CVE-2026-86950, a CoreGraphics flaw where a booby-trapped image or PDF could run code on your device.
- Apple says it may have been used in highly targeted attacks.
- Older devices get the fix too: iPhone XS, XS Max, XR and iPad (7th gen) through iOS 18.7.11.
- Go to Settings > General > Software Update now, and turn on Automatic Updates.
Understand the basics
New to this topic? These short FM TecHub guides explain the ideas behind this story.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.