Apple has pushed security updates to older iPhones and iPads that close a flaw in CoreGraphics, the framework behind much of the system's graphics handling. According to Apple, the company is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, on versions of iOS before iOS 27. MacRumors reported the details on Tuesday.
Who gets the fix
The CoreGraphics fix arrives in iOS 18.7.11 and iPadOS 18.7.11. Those releases are aimed at hardware that cannot run iOS 26: the iPhone XS, iPhone XS Max, iPhone XR and the seventh-generation iPad. Apple describes the risk as follows: processing a maliciously crafted file could lead to arbitrary code execution.
Apple released the updates on Monday, October 26, as part of a wider batch. The company also shipped iOS 26.7.2 and iPadOS 26.7.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2 and tvOS 26.6.1. According to MacRumors, the iOS 26.7.2 and iPadOS 26.7.2 releases carry security fixes for 134 vulnerabilities, none of which Apple flags as exploited in the wild.
A second CoreGraphics patch in a month
This is not the first CoreGraphics fix of the autumn. MacRumors notes that a separate out-of-bounds write flaw in the same framework, reportedly used against a small number of people, was addressed on September 28 in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
What else is in the batch
The tvOS 26.6.1 update is the only release in the group with a user-facing change. According to MacRumors, it adds support for the fourth-generation Siri Remote on the Apple TV HD and the first-generation Apple TV 4K. Apple's security notes for the macOS releases were not detailed in the MacRumors report.
How to update
On an iPhone or iPad, open Settings, then General, then Software Update. On a Mac, the path is System Settings, General, Software Update. Apple TV owners can find the option under Settings, System, Software Update.
Apple typically keeps details of actively exploited bugs brief until most users have had time to patch, so anyone with an affected device should install the update promptly. The company has not published further information on who was targeted.
0 comments