On October 26, 2026, Apple released iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2. Between them they fix 286 vulnerabilities, according to SecurityWeek's count. On the same day Apple shipped iOS and iPadOS 18.7.11 for older devices, and that's the update carrying the headline: a fix for a CoreGraphics zero-day that was exploited in targeted attacks.
If you've seen the story summarized as "iOS 27.2 fixes an exploited zero-day," that's slightly off, and the difference matters for who needs to do what. Here's how the pieces fit.
The short version
| Update | Fixes | Exploited bug? | Who needs it |
|---|---|---|---|
| iOS / iPadOS 27.2 | 163 flaws | None flagged by Apple | Every iPhone and iPad that can run iOS 27 |
| macOS Golden Gate 27.2 | 263 flaws | None flagged by Apple | Every Mac on Golden Gate |
| iOS / iPadOS 18.7.11 | 3 flaws | Yes: CVE-2026-86950 (CoreGraphics) | Older devices that can't run newer iOS, such as the iPhone XS, XS Max, and XR |
About 140 of the fixes are shared between iOS and macOS, which is why the two counts add up to more than 286.
The exploited flaw: CoreGraphics (CVE-2026-86950)
What it is. An out-of-bounds write in CoreGraphics, the framework Apple's systems use to draw 2D graphics and render images and PDFs. A maliciously crafted file can trigger it and lead to arbitrary code execution. It's scored 8.8 (CVSS 3.1). Meta Product Security reported it to Apple.
Why it's dangerous. CoreGraphics handles files that arrive from almost everywhere: the browser, Mail, and messaging apps. That gives an attacker several possible ways to deliver a booby-trapped file. Apple hasn't said which route the real attack used.
Exploitation. Apple says the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27. That wording is Apple's standard phrasing for targeted spyware-style attacks. Apple hasn't said who was targeted, how, or by whom. CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) catalog on September 29, so U.S. federal agencies are required to patch it.
The timeline.
- September 28: Apple fixed it in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Devices already on iOS 27 weren't affected.
- September 29: CISA added it to KEV.
- October 26: Apple backported the fix to iOS and iPadOS 18.7.11, for older devices that can't move to a newer major release. Those owners waited about four weeks longer than everyone else.
What's in the 27.2 releases
The 27.2 updates don't include a new bug that Apple flags as exploited, but they're still large security releases and worth installing promptly:
- WebKit: more than 30 fixes in the engine behind Safari and every iPhone browser, including use-after-free bugs that could lead to code execution from malicious web content.
- Kernel: around 15 kernel fixes on iOS, plus memory and privilege issues on macOS.
- macOS privilege and security-feature bugs: Apple's macOS advisory lists issues that could let an app gain root privileges, escape its sandbox, or bypass Gatekeeper, the check that blocks untrusted apps.
- Safari 27.2 shipped alongside for Macs that get Safari updates separately.
Apple doesn't publish severity scores for these, so treat the whole release as one update rather than trying to rank individual fixes. Web-content code execution bugs are a common first step in attack chains, which is reason enough not to wait.
Who should install what
- iPhone or iPad on iOS 27: install iOS / iPadOS 27.2.
- iPhone XS, XS Max, XR, and other devices that top out at iOS 18: install iOS / iPadOS 18.7.11. This is the update that closes the exploited CoreGraphics flaw on those devices. Reports differ on exactly which iPads get 18.7.11, so check Apple's security releases page for your model.
- Devices on iOS 26 that haven't moved to iOS 27: make sure you're on 26.7.1 or later, which has carried the CoreGraphics fix since September.
- Mac on Golden Gate: install macOS Golden Gate 27.2. On Tahoe or Sequoia, confirm you have at least 26.7.1 or 15.8.1 respectively, and install any newer update Apple offers for your version.
- Devices that can't run iOS 18: there's no published fix. Treat them as unpatched. Don't use them for sensitive accounts, and plan to replace them.
To check your version, open Settings → General → About on iPhone and iPad, or Apple menu → About This Mac on a Mac. Updates are under Settings → General → Software Update and System Settings → General → Software Update.
For IT and security teams
- Prioritize iOS 18 devices. They're the ones exposed to a known-exploited bug until 18.7.11 is installed. Use your MDM to find devices below 18.7.11 and below 26.7.1, and enforce the update with a deadline.
- Track KEV for compliance. If you follow CISA's KEV catalog, CVE-2026-86950 has been on it since September 29. Record which fixed build closes it on each OS line.
- Retire devices with no fix. Anything that can't run iOS 18 has no published patch. Block it from corporate email and apps through your MDM or conditional access.
- Roll out 27.2 on your normal fast track. No exploitation is reported, but the WebKit and kernel fixes are the kind attackers chain together.
- Consider Lockdown Mode for high-risk staff. Apple's Lockdown Mode reduces the attack surface used in targeted spyware attacks, including some file and attachment handling. It's worth offering to executives, journalists, and others likely to be singled out.
Why this one matters
The pattern here is familiar from past Apple zero-days: the newest devices get the fix first, and older hardware waits. People on older phones are often the least likely to have automatic updates on and the most likely to assume "my phone is fine." For targeted attacks, the people who get chosen aren't always on the newest hardware either.
The other lesson is about reading headlines carefully. "Exploited zero-day fixed" can describe a brand-new bug or a backport of a known one. Matching the CVE to your devices tells you whether you have new work or already finished it in September.
If you're building the skills to triage updates like this, our Google Cybersecurity Certificate review and TryHackMe SOC Level 1 review cover the defensive basics. For a broader look at this month's patch queue, see our October 2026 patch roundup.
Sources
Compiled from Apple's security notes and security reporting published September 28 to October 29, 2026. Vulnerability counts differ slightly between outlets; we've used SecurityWeek's figures. Take the definitive list of fixed builds and supported devices from Apple's security releases page.
- SecurityWeek: iOS, macOS 27.2 patch 286 bugs; fix for exploited flaw backported to iOS 18
- Apple: Apple security releases
- Apple: About the security content of macOS Golden Gate 27.2
- CISA: Known Exploited Vulnerabilities catalog
- Help Net Security: Apple squashes zero-day bug exploited in "extremely sophisticated" attack (CVE-2026-86950)
- BleepingComputer: Apple backports CoreGraphics zero-day patches to older iPhones
- TechRadar: Apple patches CoreGraphics zero-day used in targeted attacks on iOS devices
- MacRumors: iOS 27.2 fixes over 160 security vulnerabilities
- Cybersecurity News: Apple iOS 27.2 released with fixes for 163 vulnerabilities
- Mr. Macintosh: macOS Golden Gate 27.2, everything you need to know
We'll update this page if Apple reports exploitation of any 27.2 fixes or publishes more about the CoreGraphics attacks.
← All Write-ups