Apple backports exploited CoreGraphics zero-day fix to older iPhones

2026-10-28 · Cybersecurity · United States

Apple backported fixes for a high-severity CoreGraphics flaw that was exploited in real-world attacks to older iPhones and iPads, tracked as CVE-2026-86950 with a CVSS score of 8.8. The vulnerability is an out-of-bounds write that could allow arbitrary code execution when processing maliciously crafted content, and Apple said it was exploited in "extremely sophisticated" targeted attacks. Separately, the company released iOS and macOS 27.2, patching 286 vulnerabilities and bringing the exploited-flaw fix to iOS 18. The immediate effect is that users of older devices now have a path to protection, though they must install the update themselves.

Why it matters：Zero-days exploited in targeted attacks against Apple devices keep mobile fleets at risk, and backporting fixes to older OS versions shows how long the exposure tail runs for enterprise and consumer users alike.

Key points

• CVE-2026-86950 is an out-of-bounds write rated 8.8 that can lead to arbitrary code execution.
• Apple said the flaw was exploited in "extremely sophisticated" targeted attacks.
• The iOS and macOS 27.2 release patched 286 vulnerabilities and the fix reached iOS 18.

Sources (original reporting)

• The Hacker News
• SecurityWeek
• BleepingComputer

More stories from this day

• Ransomware attack forces New Mexico hospital to divert ambulances, close clinics
• CISA confirms active exploitation of PHP2Shell flaws, orders federal patching
• Polymarket faces renewed CFTC probe over US access to offshore platform
• BNEF raises US energy storage forecast by 30% on hyperscaler demand
• Strike threat at eight LA-Long Beach terminals over watchmen walkout
• US intermodal squeeze: LA-LB rail backlog grows as UP adds containers