Apple's iOS 18.7.11 advisory lists one flaw, CVE-2026-86950 in CoreGraphics, that Apple says "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." The fix shipped Oct. 26.

Who needs which update

Apple released updates for every supported iPhone and iPad on Oct. 26, per its security releases list:

  • iOS 27.2 and iPadOS 27.2: iPhone 11 and later.
  • iOS 26.7.2 and iPadOS 26.7.2: iPhone 11 and later, plus older iPads such as the iPad 8th generation and iPad mini 5th generation.
  • iOS 18.7.11 and iPadOS 18.7.11: iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation.

The exploited CoreGraphics entry appears only on the 18.7.11 page. Apple's 27.2 and 26.7.2 pages list other CoreGraphics fixes, none marked as exploited.

What the exploited bug does

Apple's entry says the CoreGraphics bug is an out-of-bounds write. Apple's impact line says processing a maliciously crafted file may lead to arbitrary code execution. It credits Meta Product Security.

Apple gives no detail on who was targeted or how, and says only that it is aware of a report.

What else Apple fixed

The iOS 27.2 page lists 162 CVE entries and the 26.7.2 page 133. In plain terms:

  • Kernel memory: 18 entries on 27.2 mention a crash or reading, writing or disclosing kernel memory.
  • Web content: Apple's 27.2 page has five entries saying crafted web content may lead to arbitrary code execution, plus others for crashes and memory disclosure.
  • Sandbox escape: App Store entry CVE-2026-112690 says a remote attacker may break out of the WebContent sandbox.
  • Privacy: apps that could read sensitive data, reach Bluetooth, or reach the camera without permission.

iOS 18.7.11 is small, with three entries: Audio, CoreGraphics and CoreMedia. The CoreMedia entry says a malicious app may access the camera without permission.

How many fixes in total

Apple's 10 advisory pages for these releases list 327 distinct CVE-2026 IDs by our count. We counted unique IDs across the iOS and iPadOS, macOS, tvOS, watchOS, visionOS and Safari pages. 9to5Mac counted 329; we have not confirmed why the two numbers differ.

What to do

On an iPhone or iPad, open Settings > General > Software Update and install the version offered. Older devices may show iOS 18.7.11, and devices on iOS 26 may show 26.7.2.

Mac users can also see macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2 and Safari 27.2 in Apple's list.

Why it matters

Apple's wording ties the exploited bug to iOS before 27, so staying on iOS 18 or 26 carries more risk than moving to 27. The trade-off is that iOS 27.2 also brings new features; see what iOS 27.2 adds and what the release candidate listed. The 18.7.11 update lists only three security entries.