Apple Issues 11 Security Updates, Extending Exploited Flaw Fix to Older iPhones

Older iPhones receive a fix for targeted attacks

Apple released 11 security updates on October 26, 2026, including a patch for an exploited graphics flaw affecting the iPhone XS, iPhone XS Max, iPhone XR and seventh generation iPad. The releases also address hundreds of vulnerabilities across newer iPhones, iPads, Macs, Apple Watches, Apple TVs, Vision Pro headsets and Safari.

The most urgent development for owners of those older devices is iOS 18.7.11 and iPadOS 18.7.11. Both fix CVE-2026-86950, a CoreGraphics vulnerability that Apple says may have been used in highly targeted attacks against people running versions earlier than iOS 27. Processing a specially crafted file could let an attacker run code on an affected device.

Apple had already fixed that vulnerability in several newer operating system releases on September 28. The October update extends protection to older hardware through a process called backporting: bringing a security repair to an earlier software version rather than requiring a move to the newest operating system.

A separate security response concerns compromised certificates from Indian certificate authority eMudhra. Apple has automatically blocked the affected web certificates in Safari, Mail and applications using its networking and security frameworks. Some Mac command line tools still need attention because they use a different file to decide which certificates to trust.

What Apple released and how the numbers add up

Apple's security release listing dates all 11 releases to October 26. The updates cover three generations of iPhone and iPad software, three Mac operating systems, two Apple TV software branches, watchOS, visionOS and Safari.

The published vulnerability counts are:

• iOS 27.2 and iPadOS 27.2: 163.
• iOS 26.7.2 and iPadOS 26.7.2: 134.
• iOS 18.7.11 and iPadOS 18.7.11: three.
• macOS Golden Gate 27.2: 263.
• macOS Tahoe 26.7.2: 213.
• macOS Sequoia 15.8.2: 197.
• tvOS 27.2: 72.
• watchOS 27.2: 62.
• visionOS 27.2: 125.
• Safari 27.2: 33.
• tvOS 26.6.1: no published CVE entries.

Those figures total 1,265 vulnerability listings across the releases, representing at least 329 distinct flaws. A vulnerability can appear in several updates because Apple products share software components. Looking only at iOS and macOS 27.2 gives 286 distinct vulnerabilities: 163 plus 263, with roughly 140 shared between them.

Why the CoreGraphics repair matters

CoreGraphics handles tasks such as drawing text and displaying images. CVE-2026-86950 is an out-of-bounds write flaw, meaning software can write information beyond the area of memory reserved for it. An attacker may use that mistake to interfere with a program or make it execute instructions chosen by the attacker.

Meta Product Security discovered the vulnerability. Apple, the company responsible for the affected operating systems, described the exploitation warning in its security notice:

Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Apple also described the technical impact and repair:

Processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking.

Bounds checking means checking that a program stays within its assigned memory space. The vulnerability was described as a zero-day because attackers had used it before a fix was available. Apple reported no other known exploitation among the vulnerabilities covered by the October releases.

The repair arrived on different software branches over several weeks:

• September 28: Apple released fixes in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
• September 29: U.S. authorities added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog.
• October 26: iOS 18.7.11 and iPadOS 18.7.11 brought the repair to the older devices listed by Apple.

The September and October release dates are 28 days apart. For owners of an iPhone XS, XS Max, XR or seventh generation iPad, the practical step is to install the update offered for that device. Apple has not publicly identified the people targeted or described how the malicious files reached them.

Three fixes protect older devices

iOS 18.7.11 and iPadOS 18.7.11 contain three listed fixes, including the CoreGraphics repair. The other two address sensitive data exposure and access to the camera without permission.

CVE-2026-65339 affects the Audio framework and could expose sensitive user information. CVE-2026-86990 affects CoreMedia and could let a malicious application access the camera without the user's permission. CoreMedia is part of the software Apple uses to manage audio and video.

Apple lists iPhone XS, iPhone XS Max, iPhone XR and seventh generation iPad as eligible for these releases. The build number is 22H384. That identifier gives users and administrators another way to check which software revision is installed.

The three fixes show why a small update can deserve prompt attention. For these devices, the release combines a repair for an exploited flaw with changes protecting private information and camera access. Owners do not need hundreds of listed fixes for an update to address serious risks.

Newer iPhones and iPads get broader repairs

Apple's iOS security advisory describes component fixes in iOS 27.2 and iPadOS 27.2, including CoreGraphics, CoreMedia, ImageIO and the kernel. The kernel is the central part of an operating system that manages hardware, memory and access between programs.

The 163 vulnerabilities include problems in WebKit, Apple's web rendering engine, and components that process images, fonts, PDF documents, audio and video. Some could allow code execution when a device processes malicious content. Others could let applications obtain sensitive data or bypass privacy settings.

The releases also fix CVE-2026-86987, an Apple Intelligence vulnerability that could let a remote attacker access sensitive information on supported iPhones and iPads. Other repairs address escapes from the WebContent sandbox, a restricted environment intended to keep web content away from the rest of the system.

Additional fixes concern impersonation of a Kerberos authentication server and access by a nearby attacker to a Thread network. Kerberos helps systems verify identities, while Thread connects compatible devices, including smart home equipment.

iOS 27.2 supports iPhone 11 and later. iPadOS 27.2 supports the fourth generation 12.9 inch iPad Pro, second generation 11 inch iPad Pro, fourth generation iPad Air, ninth generation iPad and sixth generation iPad mini, and later models in those lines. The 26.7.2 branch also covers some earlier iPads, including the eighth generation iPad, third generation iPad Air and fifth generation iPad mini.

Mac fixes reach remote access and system controls

macOS Golden Gate 27.2 has the largest individual vulnerability count, with 263. Its repairs include more than a dozen flaws that could let applications gain root access, the highest level of control over a Mac.

Apple also fixed sandbox escapes, bypasses of Gatekeeper and memory corruption problems in components handling file systems and disk images. Gatekeeper checks downloaded software before it runs, helping users avoid untrusted applications.

Screen Sharing, Remote Management and SMB, a network file sharing protocol, receive fixes as well. Some vulnerabilities can be attacked remotely or from the local network. A Remote Management flaw could allow a remote attacker to execute code, making the update particularly relevant to organisations that manage Macs over a network.

macOS Tahoe 26.7.2 addresses 213 vulnerabilities, while macOS Sequoia 15.8.2 addresses 197. The Tahoe release includes CVE-2026-43736, a Siri flaw that could let an application access sensitive user information.

Safari 27.2 is available separately for macOS Sequoia and macOS Tahoe and addresses 33 vulnerabilities. Its availability gives people staying on those Mac operating systems a browser update alongside the relevant system repairs.

Watches, televisions and headsets are included

Apple's October releases extend beyond phones and computers. watchOS 27.2 fixes 62 vulnerabilities and supports Apple Watch Series 9 and later. visionOS 27.2 fixes 125 vulnerabilities and is listed for all Apple Vision Pro models.

tvOS 27.2 addresses 72 vulnerabilities for the second generation Apple TV 4K and later. Apple TV HD and the first generation Apple TV 4K instead receive tvOS 26.6.1, which Apple labels as having no published CVE entries.

CVE numbers are public identifiers used to track security vulnerabilities. Apple's listing separates hardware compatibility from those identifiers, so checking the exact device model matters when deciding which release applies. Across a household or workplace, updating a phone alone leaves watches, televisions, headsets and computers on their existing software.

Why Apple blocked eMudhra certificates

Apple's eMudhra security notice, published October 23, describes a separate problem involving the private keys of eight intermediate certificate authorities operated by eMudhra. Six issued TLS certificates for websites, and two issued certificates used to sign software.

A website certificate acts like an identity document. A certificate authority signs it so software can check that a connection belongs to the expected website. Someone holding an intermediate authority's private key could create certificates that appear valid for other websites.

The eMudhra keys were generated with too little randomness, allowing them to be calculated from public certificates. Security researcher Scott Helme said he recovered all eight in less than a second. eMudhra attributed the weakness to a problem during a key generation ceremony on April 30, 2025, and said only one affected intermediate had been deployed in production and none had issued certificates to end users.

A researcher reported the issue on October 17. Apple began blocking 12 affected TLS certificates on October 19, then also blocked emSign ECC Root CA - G3 on October 23. There are 12 TLS certificates because each of the six affected TLS authorities has two certificate versions, connecting it to different trusted roots. eMudhra and Sectigo revoked the affected certificates.

Chrome, Firefox and Android also received blocking measures, while software projects and operating system suppliers issued changes for their own certificate stores. No malicious exploitation of the eMudhra keys had been confirmed. Apple's automatic blocks reach Safari, Mail and applications using its networking and security frameworks without requiring users to install an operating system update.

Some Mac tools still need a separate response

Mac administrators and developers face a narrower remaining issue. Some tools supplied with macOS or Xcode Command Line Tools, including curl, git, python3, ruby, perl and openssl, check certificates against /etc/ssl/cert.pem. For chains trusted through that file, these tools do not check Apple's certificate block or revocation status.

Apple says a future software update will change the file, but gave no release date. Administrators who want to act sooner can follow Apple's instructions to back it up and remove the relevant root certificates.

Removing emSign ECC Root CA - G3 blocks one trust route. Apple's notice explains that the Sectigo cross-signed certificates can still be accepted through AAA Certificate Services, so administrators can optionally remove that root too. Removing roots affects every tool relying on the file and can interrupt connections to legitimate websites using other certificates beneath those roots.

A later macOS update can replace /etc/ssl/cert.pem, so administrators using the temporary measure need to check the file after updates until Apple's permanent change arrives. Applications with their own certificate lists require separate attention from their developers.

Most Apple device owners do not need to edit certificate files. Their immediate task is to install the appropriate security updates, while organisations should also check remote management services, developer tools and applications that maintain their own trust lists. Apple credited AI tools and research teams for discovering several flaws in the broader releases, illustrating how security testing is finding problems across many shared components at once.

Key Points

• Apple released 11 security updates on October 26, 2026, covering its main operating systems and Safari.
• iOS 18.7.11 and iPadOS 18.7.11 bring an exploited CoreGraphics fix to iPhone XS, XS Max, XR and seventh generation iPad.
• The releases contain 1,265 vulnerability listings representing at least 329 distinct flaws across shared software components.
• Mac repairs include remote access vulnerabilities, while other fixes protect sensitive data and camera permissions.
• Apple automatically blocks compromised eMudhra web certificates in Safari, Mail and applications using its security frameworks.
• Some Mac command line tools require a future certificate file update or an optional administrator workaround.