On 28 September Apple shipped iOS 26.7.1 and macOS Sequoia 15.8.1 carrying exactly 1 CVE each. The single fix was CVE-2026-86950, and Apple's note on it is the wording the company reserves for the serious end of the scale: it "may have been exploited in an extremely sophisticated attack against specific targeted individuals".

The same fix reached iOS 18.7.11 on 26 October, which is 28 days later. That release is for the iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad, and those devices cannot run iOS 26 or iOS 27 at all.

What the flaw is

CVE-2026-86950 sits in CoreGraphics, the drawing and image-handling layer underneath almost everything that renders on an Apple device. The impact line reads "Processing a maliciously crafted file may lead to arbitrary code execution", the cause is an out-of-bounds write, and the fix is improved bounds checking. The credit goes to Meta Product Security.

A file that gets processed is a wide category. It covers what arrives in a message, what a browser renders, and what a preview generates without anybody opening anything.

The gap is arithmetic, not an allegation

Apple's own release index settles the timeline, and the numbers are worth laying out in order. 28 September: iOS 26.7.1 and macOS Sequoia 15.8.1, one CVE each, the exploited one. The iOS 18.7 line's previous release was 17 August, and its next one was 26 October. So the oldest supported iPhones had no update at all in that window.

For 28 days, a flaw Apple itself described as used against targeted individuals was patched on current devices and unpatched on the old ones, with the advisory text public the entire time.

Why a published fix changes the risk

A patch is a description of the bug. Anyone who wants to know where CVE-2026-86950 lives can compare the fixed code against the unfixed code, and the devices still running the unfixed code were named in the advisory by model.

None of that means mass exploitation. Apple's wording is narrow, and narrow wording from Apple usually means mercenary spyware aimed at a handful of people rather than a campaign. But a 2018 iPhone is not only owned by people who like old phones. It is owned by people who cannot replace one, and by people given a cheap handset precisely because it is not their main device, which overlaps with the population this class of attack goes after.

What else shipped that day

26 October was a large release across the line. iOS 27.2 carries 163 distinct CVEs across 69 components, from WebKit and Kernel to Shortcuts and Siri. iOS 26.7.2 carries 134. Neither carries an exploitation note, because the exploited flaw was already handled in the single-CVE releases a month earlier.

macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, tvOS, watchOS, visionOS and Safari 27.2 all shipped the same day.

What 18.7.11 actually contains

3 CVEs, which is a small release carrying one large thing. The CoreGraphics flaw above. An Audio issue where an app may be able to leak sensitive user information, fixed with improved checks. And a CoreMedia issue where a malicious app may be able to access the camera without user permission, fixed with improved access restrictions.

The second and third are not footnotes. Camera access without permission on a phone somebody has kept for years is its own small story.

What to do

  • Install 18.7.11 on any iPhone XS, XS Max, XR or 7th-generation iPad you still use, and on any you have handed to a relative.
  • On iOS 26 and 27, the exploited flaw was handled on 28 September and the 26 October release is the ordinary large one. Install it anyway.
  • If you are a plausible target of this kind of attack — journalism, legal work, activism, politics — turn on Lockdown Mode rather than relying on patch timing.
  • Treat the old-device fleet as a separate inventory with its own patch calendar. It does not move when the main fleet moves.
  • Where a device is out of support entirely, no amount of patching helps, and that is a replacement decision rather than a security one.

What is not established

  • Who was targeted, by whom, and with what. Apple names no actor, no victim and no campaign.
  • Whether anybody running iOS 18.7 was attacked during the 28-day window. Nothing has been published either way.
  • Why the backport took that long. Apple does not explain backport scheduling, and the index shows only the dates.
  • Whether iOS 27 was ever vulnerable. Apple's sentence says the attack was against versions before iOS 27, which is not quite the same statement.
  • How many devices are still on the 18.7 line. Apple publishes no breakdown at that granularity.