Apple's notes for iOS and iPadOS 18.7.11 (Oct 26, for iPhone XS, XS Max, XR and iPad 7th generation) list CVE-2026-86950, an out-of-bounds write in CoreGraphics where processing a malicious file may lead to arbitrary code execution. Apple says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Credit goes to Meta Product Security.

• The same release fixes CVE-2026-65339 (an app may leak sensitive user information, in Audio) and CVE-2026-86990 (camera access without permission, in CoreMedia).
• Apple also shipped iOS/iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, Safari 27.2, tvOS, watchOS and visionOS 27.2 the same day. CVE-2026-86950 is not listed in those notes, and none of them flags another exploited bug.

What to do: update any XS/XR-era iPhones and 7th-generation iPads still in use to 18.7.11, and move other devices to the latest iOS 27.2 or 26.7.2. People at higher risk (journalists, executives, activists) should consider Lockdown Mode.