Apple fixed an exploited flaw on 28 September. The oldest supported iPhones did not get it until 26 October
2026-10-28Security
CVE-2026-86950 went to iOS 26.7.1 and macOS Sequoia 15.8.1 in single-CVE emergency releases. The iPhone XS, XS Max and XR waited 28 days for the same fix, with the patch already public.