Apple has patched an iPhone security flaw that may have already been used in an “extremely sophisticated” attack against specific individuals.
Tracked as CVE-2026-86950, the bug affects CoreGraphics, the framework iOS uses to render visual content. A specially crafted file can corrupt memory and potentially give an attacker a foothold on the device.
Apple fixed the bug in iOS 26.7.1 and iPadOS 26.7.1 on September 28. Anyone still running an affected version of iOS should install the update.
How the attack works
CoreGraphics handles visual content deep within iOS. The vulnerability can trigger an out-of-bounds write, causing the system to place data somewhere in memory it shouldn’t.
This type of memory corruption can potentially turn into arbitrary code execution. In simpler terms, a malicious file could run the device code controlled by an attacker.
We still don’t know how attackers delivered the file or whether the victims had to interact with it. There is also not enough public information to describe this as a zero-click attack or to claim that simply receiving an image or message can compromise an iPhone. Other documented campaigns have used sophisticated iPhone hacking techniques, but there is no evidence that this attack worked the same way.
What Apple still hasn’t explained
Apple did not disclose the exact file type used in the attacks or whether CVE-2026-86950 was combined with other vulnerabilities as part of a larger exploit chain.
What it said is unusually specific about the goals. The attacks targeted specific individuals rather than widespread exploitation of anyone with an older version of iOS. Apple’s Lockdown Mode is designed for people who face this kind of highly targeted threat.
Meta Product Security reported the vulnerability, but there is no public evidence linking the attack to WhatsApp, Instagram or any other Meta service. Any such connection would still be speculation.
What iPhone users should do now
Anyone stuck on iOS 26 should install iOS 26.7.1 instead of waiting for the full technical story. Apple also continued to provide security updates for older iPhones, so keeping supported devices patched remains the safest move.
The vulnerability has also been patched on Mac, but Apple’s exploit warning specifically refers to targeted attacks against iPhone users running versions of iOS prior to iOS 27.
There is no sign that this was a mass campaign aimed at ordinary iPhone owners. The update is still the sensible move because Apple believes the flaw could already be exploited, and the delivery method remains unknown.