Apple patches older iPhones and iPads against a CoreGraphics flaw already used in real attacks

Key points

• Apple has pushed fixes for CVE-2026-86950 to older iPhones and iPads, after first patching newer devices on 28 September 2026.
• The flaw sits in CoreGraphics, the part of iOS and iPadOS that draws images and documents on screen.
• Apple says it was used in "an extremely sophisticated attack against specific targeted individuals" running versions of iOS before iOS 27.
• The US Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalogue on 29 September 2026.
• Fixed builds include iOS and iPadOS 26.7.1, macOS Sequoia and macOS Tahoe updates, plus a backport for devices running older iOS branches.

Apple has quietly extended a security fix it shipped last month, pushing the same patch down to older iPhones and iPads that a lot of people are still carrying around.

The bug, CVE-2026-86950, lives in CoreGraphics, the Apple software library that turns image files and PDFs into the pictures you actually see on screen. Rated 8.8 out of 10 for severity, it's an out-of-bounds write: a booby-trapped file can trick the system into scribbling data where it shouldn't, and from there run attacker code on the device.

Open the wrong file, lose the phone.

Apple's advisory says it's "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27". That phrasing is what Apple reaches for when commercial spyware is involved and the targets are officials or journalists rather than the general public. We covered the original fix on 29 September 2026 in "Apple Patches Actively Exploited Zero-Day Tied to WhatsApp Attack Chain", when CISA gave US federal agencies three days to remediate.

What did Apple actually ship?

The backport, first reported by The Hacker News, brings the CoreGraphics fix to devices left out of the first round on 28 September 2026. If you own an iPhone XS, XS Max, XR or an older iPad, this update is for you.

Here is how the fixed versions line up.

The National Vulnerability Database entry says the fix is a bounds check, which is the digital equivalent of measuring the shelf before you put the box on it.

Should ordinary users worry?

Probably not panic, but definitely update. The attack Apple's describing is expensive and narrowly aimed, the kind of thing sold by spyware vendors to governments. Random iPhone owners aren't the target.

Once a vulnerability is public, cheaper copycats tend to follow. The US Cybersecurity and Infrastructure Security Agency, the federal body that keeps a running list of bugs being used in real attacks, added this one on 29 September 2026. When CISA sets a remediation deadline, it's not theoretical.

If you have an older iPhone or iPad, open Settings, then Software Update, and install whatever's offered. On a Mac, the fix is bundled into the relevant macOS update.

Why the delay for older devices?

Backports take longer because the code on an older iPhone isn't the code on a current one. Apple has to rebuild and test the fix against an older operating system branch, then push it through the same release machinery.

The failure mode here is familiar. People hang onto iPhones for five or six years now, which is good for the planet and genuinely bad for patch coverage. Whenever the full story of these targeted attacks comes out, the window between the first patch and the backport will be exactly what the postmortem documents.

If the device in your pocket is more than four years old, check for updates tonight.