On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 for older iPhones and iPads. The update brings the Apple CoreGraphics zero-day patch for CVE-2026-86950 to devices like the iPhone XS, iPhone XS Max and iPhone XR, plus some older iPads, according to Apple’s security advisory. Apple had already fixed the same flaw on newer devices on September 28, 2026. Apple says the bug may have been exploited in targeted attacks, so if your device is eligible, you should install the update.
Apple fixed newer devices first, then shipped a fix for the same CVE on its older iOS 18 software branch about four weeks later. Below is what the bug does, who’s covered, and how this release fits with the other updates Apple shipped the same day. Sources cited here were retrieved October 27, 2026.
What Happened With the Apple CoreGraphics Zero-Day Patch
Apple’s iOS 18.7.11 and iPadOS 18.7.11 advisory lists three security fixes: Audio, CoreGraphics and CoreMedia. CoreGraphics is the fix Apple flags as potentially exploited; the Audio and CoreMedia entries address separate issues. CoreGraphics is one of iOS’s graphics frameworks, used for tasks such as image rendering, text drawing and other visual content. You never open it directly, but it can be used by apps and system features that render graphics, text or images.
The flaw is tracked as CVE-2026-86950. (A CVE, or Common Vulnerabilities and Exposures number, is a public ID for a specific security bug.) Apple’s advisory and BleepingComputer’s report say this about it:
- It’s an “out-of-bounds write” bug. Think of memory as a row of labeled boxes. Each task should only write in its own boxes. An out-of-bounds write happens when a booby-trapped file tricks software into writing past its boxes and into someone else’s.
- It can lead to arbitrary code execution. That means an attacker could run their own instructions on your device. Apple says processing a maliciously crafted file could trigger this. It’s one of the most serious kinds of flaw on a phone or tablet.
- It may have been used in real attacks. Apple says the bug may have been exploited in an “extremely sophisticated attack against specific targeted individuals.” That’s the meaning of “zero-day”: attackers were using it before a fix existed.
- Meta found it. Apple credits Meta Product Security with reporting the vulnerability.
Is this the same fix Apple shipped in September?
It’s the same CVE. Apple first patched CVE-2026-86950 on September 28, 2026, in iOS 26.7.1 and iPadOS 26.7.1. The Register covered that release the next day. Apple’s September advisory lists the fix for iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
The October 26 release is a backport: Apple’s advisories show the same CVE fixed in a separate release for the older iOS 18 software branch, which still runs on devices that can’t install newer versions of iOS. Apple doesn’t describe how it ported the fix.
Who This Affects
It depends on which software branch your device runs. To find yours, go to Settings > General > About and look at the version number.
Devices covered by the iOS 18.7.11 / iPadOS 18.7.11 backport
According to Apple’s advisory, the October 26 backport covers:
iPhone:
- iPhone XS
- iPhone XS Max
- iPhone XR
iPad: Apple’s advisory, as published, reads: “iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.”
That iPad line appears malformed on Apple’s page, with two entries run together, so we aren’t going to guess at the exact iPad models. The definitive check is Settings > General > Software Update: if your iPad offers iPadOS 18.7.11, it’s covered.
If you’re on iOS 26 or iOS 27
On the iOS 26 branch, the CoreGraphics fix arrived on September 28 in iOS/iPadOS 26.7.1. Apple’s advisory says the issue may have been exploited “on versions of iOS before iOS 27.” That’s Apple’s description of the affected versions, not a device-eligibility list. Apple lists which release applies to which devices separately, branch by branch. On October 26, Apple also released:
- iOS 26.7.2 and iPadOS 26.7.2
- iOS 27.2 and iPadOS 27.2
These releases include a broad set of other security fixes. Apple’s iOS 26.7.2 advisory doesn’t list CVE-2026-86950, because that fix already shipped in 26.7.1. Its entries include Accelerate Framework, AccessorySetupKit and Accounts, so these updates still matter. Install them.
Details: The Timeline at a Glance
Apple shipped this fix in stages. Here’s how the releases line up, based on Apple’s advisories:
| Release | Date | Who it’s for | CoreGraphics CVE-2026-86950 | Source |
|---|---|---|---|---|
| iOS 26.7.1 / iPadOS 26.7.1 | Sept 28, 2026 | Newer devices (iPhone 11 and later, recent iPads) | Fixed (original patch) | Apple 149226 |
| iOS 18.7.11 / iPadOS 18.7.11 | Oct 26, 2026 | Older devices (iPhone XS/XS Max/XR, older iPads) | Fixed (backport) | Apple 149225 |
| iOS 26.7.2 / iPadOS 26.7.2 | Oct 26, 2026 | Devices on the iOS 26 branch | Not listed (already fixed in 26.7.1); other fixes included | Apple 149227 |
| iOS 27.2 / iPadOS 27.2 | Oct 26, 2026 | Devices on the iOS 27 branch | Not listed (Apple says exploitation affected versions before iOS 27); other fixes, including separate CoreGraphics CVEs | Apple 149230 |
The gap between the first fix and the backport was 28 days.
How It Stacks Up
Against Apple’s own previous release
The useful comparison here is Apple against itself. Owners of iPhone 11 and later got protection on September 28. Owners of the iPhone XS, XS Max, XR, and the older iPads listed above waited until October 26. That’s a four-week window. During it, a bug Apple said may have been exploited in attacks remained unpatched on older hardware.
There’s a positive side, too. These devices no longer get the newest major version of iOS. Apple could have left them unpatched and told owners to upgrade. Instead, it adapted the fix for the older branch. If you still use an iPhone XR as a backup phone, or an older iPad as a family tablet, check Software Update for 18.7.11.
Against Android and Windows
We looked for a comparable Android advisory (Google Pixel or Samsung Galaxy) or a Windows/Microsoft advisory for a similar graphics-component zero-day. We couldn’t verify one in the sources available for this story. So we won’t say whether Apple moved faster or slower than Google, Samsung, or Microsoft on this kind of flaw. Any claim like that would be guesswork.
If you’re switching from Android or Windows, one habit is worth knowing. Apple’s security advisories typically list the affected products, vulnerability identifiers when available, and reporter credits when provided. That makes it easy to check what a given update fixes.
The Reaction
Reaction is still forming. The social posts we could gather mostly repeated Apple’s advisory: which devices are covered, and that users should update. We found no linkable posts or Hacker News discussion that adds a real argument beyond the facts above.
Our Take
Verdict: Apple did the right thing, but later for older devices, and we can’t fairly compare it with competitors.
Compared with its own September fix, Apple was four weeks slower for iPhone XS and XR owners. That’s a real gap for a bug Apple says may have been used in attacks. Still, it beats the alternative. Apple keeps fixing bugs it says may have been exploited on hardware that no longer gets major iOS upgrades. That makes these older devices safer to keep as hand-me-downs, kids’ tablets, or backup phones.
The targeting matters too. Apple describes the attacks as aimed at “specific targeted individuals.” That suggests everyday users weren’t the intended victims. But after a fix ships, researchers may study the change to understand the flaw, so there’s little to gain by waiting.
Should you update? Yes, promptly, but no need to panic. Install iOS 18.7.11 or iPadOS 18.7.11 if your device is on the list. On a newer device, install the update offered for your model: iOS 26.7.2 for supported devices on the iOS 26 branch, or iOS 27.2 for supported devices on the iOS 27 branch. Settings > General > Software Update shows the right one.
Should you buy a new iPhone because of this? Not because of this patch alone. Apple has shown that it is still willing to patch serious bugs on the XS and XR. But these devices are on an older software branch. Fixes may arrive later than on newer models, as they did here.
If your iPhone XS or XR is your main phone and you handle sensitive accounts on it, factor that delay into your next upgrade decision. In this case, the iPhone 11 and later models covered by iOS 26.7.1 got the fix first. Check which iOS version a refurbished model runs before you buy.
What to Do Next
Go to Settings > General > Software Update on your iPhone or iPad and install whatever update is offered. On older devices, that should be iOS 18.7.11 or iPadOS 18.7.11.
A few quick tips:
- Connect to Wi-Fi and plug into a charger. Updates usually download faster on Wi-Fi, and an update may need enough battery or a charger to install. If your old Lightning cable or power adapter is fraying, now’s a good time to replace it.
- If the update doesn’t show up yet, don’t worry. Check again later, and check Apple’s advisory to see whether your model is listed.
- Consider turning on Automatic Updates. You’ll find it under Settings > General > Software Update > Automatic Updates. The default depends on your device setup, so it’s worth a look. With it on, future security fixes like this one can install without you having to remember.
You don’t need to do anything beyond a normal software update. Apple’s advisory doesn’t list any extra steps.
Wrapping Up
Apple brought its September CoreGraphics fix to the iPhone XS, XS Max, XR and older iPads four weeks later. The delay isn’t ideal, but Apple deserves credit for not abandoning older hardware.
| Step | Action | Applies To |
|---|---|---|
| 1 | Check your version in Settings > General > About | All iPhones and iPads |
| 2 | Install iOS/iPadOS 18.7.11 | iPhone XS, XS Max, XR, and iPads that Software Update offers it to |
| 3 | Install iOS/iPadOS 26.7.2 or 27.2 | Devices on the iOS 26 or iOS 27 branch |
| 4 | Turn on Automatic Updates if you want future fixes to install on their own | All iPhones and iPads |