Apple fixed an exploited CoreGraphics bug in September. Older iPhones got it Monday.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Monday 26 October Apple backported the fix for CVE-2026-86950, a CoreGraphics out-of-bounds write, to iOS and iPadOS 18.7.11. Apple says it may have been used in a highly sophisticated attack on specific individuals, on iOS versions before iOS 27. The first fix shipped in September in 26.7.1, after Meta's product security team found it.
Why it matters
Opening a crafted file can run attacker code. Apps that take images or documents from users sit close to that path, and phones still on an old build stay exposed.
What to do
Update company iPhones and iPads to the newest release for their iOS line, at least iOS 18.7.11 on iOS 18, and ask customers on older devices to do the same.
My take
Lior Aharonov
Founder, 7IT Solutions
A bug patched in September reached older iPhones in late October. About a month is a long time to carry a known-exploited hole.
Sources
Researched with AI tools; every fact is checked against the linked sources.