{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "macos-coregraphics-zero-day-sept-2026",
  "url": "https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026/",
  "path": "/incidents/macos-coregraphics-zero-day-sept-2026/",
  "json_url": "https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026.json",
  "title": "Mac and iPhone: a bad file could take over your device, and Apple says it was used in real attacks",
  "category": "mac",
  "platforms": [
   "macos",
   "ios"
  ],
  "products": [
   "macos",
   "iphone-ios"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "NVD score 8.8 out of 10 (CVE-2026-86950)",
  "exploited_in_wild": "yes",
  "exploited_note": "Apple says it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iPhones before iOS 27. CISA lists it as exploited (added Sept 29, 2026).",
  "exploited_source_url": "https://support.apple.com/en-us/149229",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-09-28",
  "updated_at": "2026-10-28",
  "cves": [
   "CVE-2026-86950"
  ],
  "summary": "A bug in the part of Apple's software that draws pictures and files (CoreGraphics) could let a bad file run a program on your Mac, iPhone or iPad. Apple says it was used in a very targeted attack on iPhones. Apple fixed it on September 28, 2026, and on October 26 it sent the same fix to older iPhones and iPads (iOS 18.7.11). The newer October 26 Mac updates also include the fix.",
  "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.7.1 or macOS Sequoia older than 15.8.1, or if your iPhone or iPad runs iOS 26 older than 26.7.1 or iOS 18 older than 18.7.11. If you installed the October 26 updates you are covered.",
  "action": "Update your Mac (Tahoe 26.7.1 / Sequoia 15.8.1 or newer) and your iPhone or iPad (iOS 26.7.1 / 18.7.11 or newer)",
  "affected": [
   {
    "product": "macos",
    "product_name": "macOS",
    "platform": "macos",
    "affected_versions": "macOS Tahoe before 26.7.1; macOS Sequoia before 15.8.1",
    "fixed_version": "26.7.1 (Tahoe) / 15.8.1 (Sequoia)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/149228",
     "https://support.apple.com/en-us/149229"
    ],
    "check": {
     "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
     "command": "sw_vers -productVersion",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   },
   {
    "product": "iphone-ios",
    "product_name": "iPhone and iPad (iOS)",
    "platform": "ios",
    "affected_versions": "iOS and iPadOS 26 before 26.7.1; iOS and iPadOS 18 before 18.7.11 (older iPhones such as iPhone XS and XR)",
    "fixed_version": "26.7.1 / 18.7.11",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/149226",
     "https://support.apple.com/en-us/149225"
    ],
    "check": {
     "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://support.apple.com/en-us/100100"
   }
  ],
  "fix_steps": [
   "On a Mac: click the Apple menu > System Settings > General > Software Update, then click Update Now.",
   "On an iPhone or iPad: open Settings > General > Software Update and install the newest version.",
   "Restart when asked."
  ],
  "official_patch_links": [
   {
    "label": "Apple: how to update your Mac",
    "url": "https://support.apple.com/en-us/108382"
   },
   {
    "label": "Apple: how to update your iPhone or iPad",
    "url": "https://support.apple.com/en-us/118575"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://support.apple.com/en-us/149228",
    "title": "Apple: About the security content of macOS Tahoe 26.7.1",
    "date": "2026-09-28",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/149229",
    "title": "Apple: About the security content of macOS Sequoia 15.8.1",
    "date": "2026-09-28",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities entry for CVE-2026-86950",
    "date": "2026-09-29",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86950",
    "title": "NVD: CVE-2026-86950",
    "date": "2026-09-28",
    "kind": "nvd",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/149226",
    "title": "Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1",
    "date": "2026-09-28",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/149225",
    "title": "Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11",
    "date": "2026-10-26",
    "kind": "vendor",
    "official": true
   }
  ]
 }
}