NewsCompaniesFlawsGuides
Get the app

Apple brings its fix for an exploited flaw to the iPhone XS, XS Max, XR and seventh-generation iPad

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
support.apple.com: About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support
Screenshot: support.apple.com

Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October to fix CVE-2026-86950 on these older devices. Processing a malicious file could let an attacker run code; Apple says it has received a report of possible exploitation against selected individuals using iOS versions before iOS 27.

Apple has brought a security fix to iPhone XS, XS Max, XR and seventh-generation iPads. Check yours, and the devices you look after for someone else.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If anyone in the family uses an iPhone XS, XS Max, XR or seventh-generation iPad, check its software today. Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October, bringing these older devices a fix for a flaw linked to targeted attacks. Apple's release catalogue[1] confirms the versions and models.

The same flaw was patched in iOS 26.7.1 and iPadOS 26.7.1 on 28 September. Apple says[2] it has received a report that it may have been used against selected people running iOS versions before iOS 27. The US cybersecurity agency CISA added CVE-2026-86950 to its known exploited vulnerabilities catalogue on 29 September, according to the Canadian Centre for Cyber Security[3].

Older Apple devicesCVE-2026-86950
HARD level
High Exploited flaw; fix available
iPhones
XS, XS Max and XR: iOS 18.7.11
iPad
Seventh generation: iPadOS 18.7.11
Update released
26 October 2026
What's known. Versions, release date and devices from Apple's release catalogue[1]; vulnerability details from Apple's security advisory[4].

Timeline

  1. HARD publishes its article, at High.

Who is affected

Start with the four models above if they have not installed 18.7.11. Include a parent's phone, a child's handed-down iPhone and the iPad used at home in your checks.

The published device lists differ. BleepingComputer[5] and The Hacker News[6] also list newer iPads for 18.7.11; Apple's release catalogue lists only the four models in the box. For another model, install the latest update offered in Software Update.

What the flaw could do

The weakness is in CoreGraphics, Apple's graphics software. Processing a specially made file could let an attacker run their own code on the device. Apple credits Meta Product Security[2] with reporting the flaw.

Apple describes the reported attack as “extremely sophisticated”. Its advisory does not name the people targeted, give a victim count or explain how the file reached them. That limits what we can say about personal exposure. HARD's advice is to install the available fix today.

What to do

  1. Install the update today.Back up the device, plug it into power and connect to Wi-Fi. Open Settings > General > Software Update and follow the installation prompts. For the four models above, the fix is 18.7.11; install a newer update if offered. Apple's update guide[7] explains the process.
  2. Check that it finished.Return to Software Update and read the installed version. Help your parents or anyone else whose devices you look after complete this check too.
  3. Turn on automatic installation.Open Automatic Updates on the same screen and enable installation of software updates. Keep the device charging and connected to Wi-Fi overnight.
  4. Get help if the update will not appear.Apple's guide includes updating through a Mac or Windows computer. Ask the person who supports the family's devices to help if needed.
  • CVE-2026-86950 Opening a booby-trapped file can let an attacker run their own code through Apple devices.
  • Apple every Apple flaw being used in attacks

References

  1. ^ Apple. “Apple security releases”. Lists 18.7.11 for iPhone XS, XS Max, XR and seventh-generation iPad, released 26 October.
  2. ^ Apple (). “About the security content of iOS 26.7.1 and iPadOS 26.7.1”. Earlier fix, code-execution impact, Meta credit and reported targeted exploitation.
  3. ^ Canadian Centre for Cyber Security (). “Apple security advisory (AV26-971)”. Confirms CISA added CVE-2026-86950 to its known exploited vulnerabilities catalogue on 29 September.
  4. ^ Apple (). “About the security content of iOS 18.7.11 and iPadOS 18.7.11”. Fix, release date, impact and Apple's qualified exploitation statement; read through indexed page content after direct requests returned 429.
  5. ^ BleepingComputer (). “Apple backports CoreGraphics zero-day patches to older iPhones”. Reports the backported fix and a broader iPad availability list than Apple's release catalogue.
  6. ^ The Hacker News (). “Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads”. Identifies 18.7.11 and repeats the broader iPad availability list.
  7. ^ Apple (). “Update your iPhone or iPad”. Backup, power, Wi-Fi, manual updates, automatic installation and computer update options.
  8. Malwarebytes (). “Have an older iPhone or iPad? Apple has a security update for you”. Explains the older-device fix, CoreGraphics and update steps; its table matches Apple's release catalogue.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.