Apple pushed out iOS 18.7.11 and iPadOS 18.7.11 on Tuesday, and this one matters even if your iPhone can't run the newest software. The update closes an actively exploited security hole in CoreGraphics, the graphics framework Apple uses across iOS, iPadOS, macOS, watchOS and tvOS to draw text, images and vector shapes.
The flaw is tracked as CVE-2026-86950 and carries a severity score of 8.8 out of 10. Apple's own release notes describe it in blunt terms: "Processing a maliciously crafted file may lead to arbitrary code execution." The company says it fixed the bug with improved bounds checking, which addresses what's known as an out-of-bounds write, a class of memory bug that lets an attacker write data outside the space it was supposed to stay in, potentially corrupting a device or running unauthorized code.
Meta's Product Security team reported the issue. And Apple confirms it already knows the bug was used in the wild, stating it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Apple hasn't said who those targets were or how the malicious files reached them.
What makes this release notable is the backport. Apple already fixed the same CoreGraphics flaw in September, when it shipped iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Rolling that same fix back to the iOS 18 branch, which Apple maintains for devices too old to run iOS 26 or iOS 27, isn't something the company does routinely. It only happens when a bug is serious enough, or exploited widely enough, to justify the extra engineering work on a legacy codebase.
That puts CVE-2026-86950 in rare company. It's the second zero-day Apple has had to patch in active attacks this year. The first, CVE-2026-20700, hit dyld, the dynamic link editor that loads code into Apple's operating systems, and was fixed back in February after Apple found it being used in similarly targeted attacks.
The iOS 18.7.11 and iPadOS 18.7.11 update covers the iPhone XS, iPhone XS Max and iPhone XR, along with a range of older iPads still supported on that software track. Anyone already running iOS 26.7.1 or iPadOS 26.7.1 got this fix back in September and doesn't need to do anything further.
Apple frames the attacks as narrow, aimed at specific individuals rather than a mass campaign. But the mechanics of the bug don't require much from an attacker. A single crafted file is enough to trigger it, so a device that hasn't installed the patch stays exposed to anyone who gets hold of a working exploit. The fix is available now through Settings, General, then Software Update, and it's worth installing regardless of how likely you think you are to be a target.
MDFiled by The Mobile Desk
Phones from leak to launch to price cut: what was announced, what it costs where, and when it goes on sale. Indian launches and prices included, not appended.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.