On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11, backporting its fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics, to devices that cannot run iOS 26 or 27.

Apple says processing a maliciously crafted file may lead to arbitrary code execution, and that the flaw was addressed with improved bounds checking.

The update covers the iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Meta Product Security is credited with reporting the flaw.

The surprise is the timing, not the bug. Older devices stuck on iOS 18 received nothing for nearly a month.

SQ Magazine notes that a fix shipping on newer software first can point attackers toward the bug while older devices wait weeks for their own build. Apple's warning explicitly covers versions of iOS before iOS 27, a range that includes the iOS 18 builds these phones still run.

Apple states it is aware of a report that the issue 'may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.'

According to Rescana's CVE Analysis Center, CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 29, 2026 with an October 13 remediation due date for US federal civilian agencies, set exploitation to 'active' in its SSVC assessment, and scored it CVSS 3.1 8.8 High.

iOS 18.7.11 also patches CVE-2026-65339, a logic flaw in the Audio component that a malicious app could use to leak sensitive user information, credited to Mustafa Calap and Nik Tsytsarkin of Meta Red Team X, and CVE-2026-86990, a CoreMedia access flaw that could let a malicious app reach the camera without user permission, credited to Mustafa Calap.

Apple has not flagged either of these as exploited. The release also arrived alongside iOS 27.2 and matching updates that fix hundreds of vulnerabilities, including an Apple Intelligence authorization issue, CVE-2026-86987, though none of those is tied to real-world attacks.

This is the second exploited zero-day Apple has fixed this year, after the dyld flaw CVE-2026-20700 patched in February, BleepingComputer reports.

The Hacker News notes the CoreGraphics bug needs only a booby-trapped file delivered by email, message or download, so unexpected attachments on older iPhones deserve the same suspicion as on desktops.

For organizations, Rescana recommends using MDM to find devices still below 18.7.11 and covering personal devices through conditional access policies.

Users of affected devices should open Settings, go to General, then Software Update, and install iOS 18.7.11 or iPadOS 18.7.11, ideally backed up, connected to power and on Wi-Fi.

Owners of newer iPads covered by both branches can update to iOS 26.7.1 or later instead, and Apple has also shipped iOS and iPadOS 26.7.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2, which follow the fixed versions. Checking Settings, General, About confirms the installed version.

Patching closes the disclosed flaws, but neither Apple nor CISA has published indicators of compromise, so an update alone cannot determine whether a device was previously compromised.