Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026, to fix a CoreGraphics flaw that Apple says may have been exploited in an extremely sophisticated attack against specific targeted individuals. Install the latest security update available for your device; the public advisory does not establish who carried out the reported attack, how it reached targets, or whether spyware was involved.
What does CVE-2026-86950 do?
CVE-2026-86950 is an out-of-bounds write vulnerability in Apple’s CoreGraphics component. Apple says processing a maliciously crafted file may lead to arbitrary code execution. The fix improves bounds checking. Singapore’s Cyber Security Agency (CSA) assigns the flaw a CVSS v3.1 score of 8.8 out of 10.
As an Amazon Associate I earn from qualifying purchases.
Apple’s September 28 security advisory says the company is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions before iOS 27. Apple credits Meta Product Security for reporting the issue. This wording describes a report of possible exploitation, not a public account of the attack’s mechanics.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do I need to update my iPhone now?
Yes. Install the latest applicable Apple security update as soon as you can. Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026. Because Apple may publish later updates, check the current release information and install the newest version offered for your device rather than relying only on a version number in an older alert. [Apple security releases]
#1 Best Overall
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- When you receive the phone, insert a SIM card from a compatible carrier. Then, turn it on, connect to Wi-Fi, and follow the on screen prompts to activate service.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charger and charging cable.
- Tested for battery health and guaranteed to have a minimum battery capacity of 80%.
- On an iPhone or iPad, open Settings > General > Software Update.
- Allow the device to check for updates. If an update is offered, review its version and tap Download and Install.
- After installation, return to Settings > General > Software Update and confirm the device reports that its software is up to date.
For a Mac, use Apple menu > System Settings > General > Software Update and install the latest update available for that Mac and macOS version.
Which iPhones, iPads and Macs are affected?
Apple’s advisory lists iPhone 11 and later and specified iPad generations for its iOS and iPadOS fixes. The CSA says versions before the following updates are affected:
Rank #2
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- When you receive the phone, insert a SIM card from a compatible carrier. Then, turn it on, connect to Wi-Fi, and follow the on screen prompts to activate service.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charger and charging cable.
| Operating system | Affected versions | Update identified by CSA |
|---|---|---|
| iOS | Before iOS 26.7.1 | iOS 26.7.1 |
| iPadOS | Before iPadOS 26.7.1 | iPadOS 26.7.1 |
| macOS Tahoe | Before macOS Tahoe 26.7.1 | macOS Tahoe 26.7.1 |
| macOS Sequoia | Before macOS Sequoia 15.8.1 | macOS Sequoia 15.8.1 |
The CSA’s version cutoffs are specific to the operating-system branches it lists. Check Apple’s security release information for the latest update that applies to your model and installed operating system. [Cyber Security Agency of Singapore alert]
Recommended Free Tools
What is known—and not known—about the reported attack?
Apple’s advisory establishes that the company received a report of possible exploitation against specific targeted individuals using versions before iOS 27. It does not say how a malicious file was delivered or identify an attacker, a victim count, or spyware use. TechCrunch also reports that the attackers’ identities and number of affected people remain unclear. A web page, email, message or other delivery route should not be treated as confirmed.
Rank #3
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- When you receive the phone, insert a SIM card from a compatible carrier. Then, turn it on, connect to Wi-Fi, and follow the on screen prompts to activate service.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charger and charging cable.
- Tested for battery health and guaranteed to have a minimum battery capacity of 80%.
The spyware context is broader than this vulnerability. Computerworld reported that Apple sent threat warnings to customers in 110 countries in August 2026; that figure concerns warnings, not confirmed victims of CVE-2026-86950. Likewise, TechCrunch reported on September 29, 2026, citing Apple statistics, that almost four out of five iPhone owners were still running iOS 26. That is a dated adoption snapshot, not a measure of exposure to this particular flaw.
Do not confuse this patch with a separate iMessage flaw
TechCrunch separately reported on CVE-2026-86869, which security firm ironPeak described as a zero-click issue involving a crafted iMessage and Apple’s BlastDoor messaging security feature. According to that reporting, Apple fixed that issue with iOS 27, iPadOS 27 and macOS 27; whether it was exploited before the fixes is not known. That is a different vulnerability from CVE-2026-86950. Apple’s public notice for CVE-2026-86950 describes processing a maliciously crafted file and does not establish an iMessage delivery path.
Rank #4
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- When you receive the phone, insert a SIM card from a compatible carrier. Then, turn it on, connect to Wi-Fi, and follow the on screen prompts to activate service.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charger and charging cable.
- Tested for battery health and guaranteed to have a minimum battery capacity of 80%.
What else should higher-risk users do?
Updating is the direct response to this flaw. Avoiding untrusted apps, suspicious links and unexpected prompts to install files or apps remains sensible general security practice, but it is not a substitute for applying the patch.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsComputerworld suggests considering Lockdown Mode for people who have received an Apple threat notification or face elevated targeting risk. It is a protective option for a higher-risk threat model, not a fix for an unpatched device and not a guarantee against every attack. As reported by Computerworld, Apple spokesperson Sarah O’Rourke said: “We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device.” That statement is limited to the attacks Apple was aware of and to devices with Lockdown Mode enabled; it does not establish that the mode prevents all attacks.
Quick Recap
Best Value
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- When you receive the phone, insert a SIM card from a compatible carrier. Then, turn it on, connect to Wi-Fi, and follow the on screen prompts to activate service.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charger and charging cable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
