Apple released iPhone, iPad, and Mac security updates to fix a zero-day flaw that may already have been used against specific people. The bug, CVE-2026-86950, is an out-of-bounds write in CoreGraphics that can allow code execution when a device processes a specially crafted file, potentially via web content, email attachments, messages, or preview rendering. Apple patched it in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and said Meta reported the issue.
Why it matters: People and organizations using older supported Apple devices should update quickly because this flaw may have been exploited in highly targeted attacks and could be triggered by simply handling a malicious file. The concrete action is to install the latest iOS, iPadOS, or macOS update on affected systems now.
2026.09.29
99% relevant
This article reports the same underlying event: Apple’s fix for CoreGraphics zero-day CVE-2026-86950. It adds that Meta Product Security reported the bug, that Apple describes the exploitation as an 'extremely sophisticated attack' against specific individuals on iOS versions before iOS 27, and lists the iOS 26.7.1 and iPadOS 26.7.1 updates and affected device families.
Eduard Kovacs
2026.09.29
100% relevant
This article appears to be the first concrete report here tying CVE-2026-86950 to Apple's newly released fixes and to possible in-the-wild exploitation against targeted individuals.
← Back to all stories