iPhone XS and XR get a fix for an exploited CoreGraphics bug in iOS 18.7.11
Apple patched an exploited CoreGraphics flaw on iPhones stuck on iOS 18; Macs got the same fix in September.
Apple · Macfolio · 28 October 2026
Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, alongside iOS 27.2. Apple's security note says the update fixes a CoreGraphics flaw, CVE-2026-86950, that "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Processing a maliciously crafted file could lead to arbitrary code execution. Meta Product Security is credited with the report.
Who needs this update
iOS 18.7.11 is for devices that cannot run iOS 26 or later. Apple's security releases page lists:
- iPhone XS and iPhone XS Max
- iPhone XR
- iPad (7th generation)
The same update also fixes an Audio bug that could let an app leak sensitive information and a CoreMedia bug that could let a malicious app use the camera without permission.
Macs and newer iPhones were patched earlier
This is not a new zero-day for Mac users. Apple fixed the same CVE on September 28 in iOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The October 26 releases of iOS 26.7.2, macOS Tahoe 26.7.2, and macOS Sequoia 15.8.2 do not flag any exploited bugs. If your Mac is current, there is nothing extra to do.
The iOS 18 release closes the gap for older hardware that was left exposed for about a month after the fix reached newer devices.
What to do
On an affected iPhone or iPad, go to Settings, General, Software Update and install iOS 18.7.11. Admins should check MDM reports for XS, XR, and 7th generation iPad devices that still connect to company mail or apps.
This does not mean ordinary users were widely attacked. Apple's wording describes targeted attacks, and it has not named victims or the attacker.
Our take: this is a good reminder that older devices in a fleet get fixes later. If staff still use an iPhone XS or XR for work accounts, now is a good time to plan a replacement.
Caveats: Apple gives few details by design, and its note for iOS 18.7.11 has a garbled device list. We relied on the security releases index for the device list.