If your staff use iPhones for email, banking apps, WhatsApp Business or two-factor codes, one item in Apple's 26 October 2026 update batch is worth ten minutes of your time. Apple has now shipped the fix for CVE-2026-86950, a flaw it says may have been exploited in an extremely sophisticated attack, to older iPhones too.
What happened
Apple's security documents describe CVE-2026-86950 as an out-of-bounds write issue in CoreGraphics, the part of the system that handles graphics. The impact Apple lists is that processing a maliciously crafted file may lead to arbitrary code execution. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Apple credits Meta Product Security with the finding.
The timeline from Apple's pages:
| Date | Update | Notes |
|---|---|---|
| 28 September 2026 | iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 | First fixes for CVE-2026-86950 |
| 29 September 2026 | CISA adds the CVE to its Known Exploited Vulnerabilities catalog | Federal due date was 13 October 2026 |
| 26 October 2026 | iOS 18.7.11 and iPadOS 18.7.11 | Brings the same fix to iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation |
The 18.7.11 update also lists two other fixes: CVE-2026-65339 in Audio (an app may be able to leak sensitive user information) and CVE-2026-86990 in CoreMedia (a malicious app may be able to access the camera without user permission).
Apple released many other updates on 26 October, including iOS 27.2, iOS 26.7.2 and macOS updates. We have not covered their full contents here, so read Apple's security releases page for your device.
Should a small business worry?
Apple's wording points to attacks on specific targeted individuals, so most owners are not the intended victim. Still, a flaw that CISA lists as exploited, fixable by a routine update, is exactly the kind of risk that costs almost nothing to remove. Phones hold email, authentication codes and customer chats, so an unpatched one is a poor place to take a chance.
What to do today
- List the Apple devices your team uses, including personal phones that access work email or WhatsApp Business.
- Update each one through Settings, General, Software Update. Back up first and use power and Wi-Fi.
- Check the version afterwards. Older iPhone XS, XS Max and XR models should show iOS 18.7.11 or later; newer devices should be on the latest update Apple offers for them.
- Update Macs too. Apple lists macOS Tahoe 26.7.2 and Sequoia 15.8.2 among the 26 October releases.
- Turn on automatic updates so the next fix does not wait for a reminder.
- Retire devices that no longer get updates. If a phone cannot install current security fixes, plan its replacement, especially if it handles business accounts.
- Treat unexpected files with care. The flaw involves processing a crafted file, so do not open attachments or images you did not expect, even from known contacts.
A simple policy for a small team
Write one page: staff must install updates within a set number of days, devices that stop receiving updates are replaced, and work accounts use two-factor authentication. If you manage many devices, a mobile device management tool can enforce this. For app owners, our mobile app security checklist covers what to protect on the app side, and if your business runs websites and apps, our website maintenance guide explains routine patching. If you want help with either, see our mobile app development service or contact us.
Sources
- Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 (26 October 2026)
- Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1 (28 September 2026)
- Apple: Security releases (list of 26 October 2026 updates)
- CISA: Known Exploited Vulnerabilities catalog (CVE-2026-86950, added 29 September 2026)
