Patch Gap

Mac · updated Oct 28, 2026

Mac and iPhone: a bad file could take over your device, and Apple says it was used in real attacks

Patched: update nowBeing attacked nowHigh

Last checked · Check before installing; only use the official link.

A bug in the part of Apple's software that draws pictures and files (CoreGraphics) could let a bad file run a program on your Mac, iPhone or iPad. Apple says it was used in a very targeted attack on iPhones. Apple fixed it on September 28, 2026, and on October 26 it sent the same fix to older iPhones and iPads (iOS 18.7.11). The newer October 26 Mac updates also include the fix.

Status
Patched: update now
Being attacked?
Yes[2]
Severity
High
Updated

Apple says it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iPhones before iOS 27. CISA lists it as exploited (added Sept 29, 2026). Severity: NVD score 8.8 out of 10 (CVE-2026-86950) First reported .

Am I affected?

You are at risk if your Mac runs macOS Tahoe older than 26.7.1 or macOS Sequoia older than 15.8.1, or if your iPhone or iPad runs iOS 26 older than 26.7.1 or iOS 18 older than 18.7.11. If you installed the October 26 updates you are covered.

AppDeviceAffectedFixed in
macOSMacmacOS Tahoe before 26.7.1; macOS Sequoia before 15.8.126.7.1 (Tahoe) / 15.8.1 (Sequoia)[1][2]
iPhone and iPad (iOS)iPhone / iPadiOS and iPadOS 26 before 26.7.1; iOS and iPadOS 18 before 18.7.11 (older iPhones such as iPhone XS and XR)26.7.1 / 18.7.11[5][6]

How to check your version

These checks only look. They do not change anything on your computer.

macOS on Mac

Easy way: Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.

Or type this in TerminalRead-only. It only reads the version and changes nothing.

sw_vers -productVersion

iPhone and iPad (iOS) on iPhone / iPad

Easy way: On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.

How to fix it

  1. On a Mac: click the Apple menu > System Settings > General > Software Update, then click Update Now.
  2. On an iPhone or iPad: open Settings > General > Software Update and install the newest version.
  3. Restart when asked.

More on each app: Is my Mac up to date?, Is my iPhone up to date?

Official links

Check before installing, and only use these official links or the app's own update button.

For AI agents

This page as data: /incidents/macos-coregraphics-zero-day-sept-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.

Tracking numbers (CVE): CVE-2026-86950

Sources

  1. MakerApple: About the security content of macOS Tahoe 26.7.1 (Sep 28, 2026)
  2. MakerApple: About the security content of macOS Sequoia 15.8.1 (Sep 28, 2026)
  3. CISACISA: Known Exploited Vulnerabilities entry for CVE-2026-86950 (Sep 29, 2026)
  4. NVDNVD: CVE-2026-86950 (Sep 28, 2026)
  5. MakerApple: About the security content of iOS 26.7.1 and iPadOS 26.7.1 (Sep 28, 2026)
  6. MakerApple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 (Oct 26, 2026)

"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.