On 26 October Apple released iOS 18.7.11 and iPadOS 18.7.11 for older devices such as the iPhone XS, XS Max and XR and some older iPads. The update fixes CVE-2026-86950 in CoreGraphics, where a maliciously crafted file can lead to code execution. Apple says the flaw may have been exploited in an extremely sophisticated attack against specific individuals on versions before iOS 27. Newer devices received the fix the previous month.

What it means: Apple keeps fixing serious flaws even on devices that cannot move to the latest operating system, which is good news for people who keep a phone for many years. The fact that the fix arrived a month after the newer devices, however, means owners of older models were exposed for a while to a flaw that was already in use. Attacks that Apple describes as extremely sophisticated usually involve spyware aimed at journalists, activists, politicians and business executives, not the average user. Still, once a flaw is public, the technique spreads to less sophisticated attackers too. Greek companies that give older iPhones to staff or allow personal devices for company email should use their device management tool to see which ones have not updated and set a minimum software version for access to company data. Devices that no longer receive security updates should be replaced, especially when used by executives or people handling sensitive information. Lockdown Mode offers extra protection for high-risk individuals.

Read the original on Apple

Related service: Custom software

Related stories