Apple’s New iPhone Attack Is a Serious Threat
by Jerome London · Thought CatalogUpdated 2 minutes ago, October 28, 2026
Apple says an iPhone security flaw may have been used against specific people in an “extremely sophisticated attack.” A file designed to exploit it could let an attacker run code inside the app that processes it. Apple released another fix on October 26 for older iPhones, including the XS, XS Max, and XR.
The flaw, CVE-2026-86950, affects CoreGraphics, Apple’s software for drawing text and images and handling PDFs. It can let data spill beyond an allocated section of memory. The National Vulnerability Database gives it a severity score of 8.8 out of 10, rated High.
Apple’s warning concerns possible attacks on people using versions of iOS before iOS 27. It hasn’t identified the attackers or targets, disclosed how the files arrived, or confirmed that anyone’s phone was fully compromised. Running code inside an affected app would require additional vulnerabilities to become full device control.
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 29, indicating evidence of exploitation in the real world. Federal agencies had an October 2 patch deadline.
Researchers at Calif, Dion Blazakis, Josh Maine, and Anna Groza, examined the September fix and traced the problem to the way CoreGraphics draws characters from fonts. Their test PDF contained an embedded font that crashed unpatched iPhones and Macs when previewed. That demonstration didn’t achieve code execution, and the researchers said they hadn’t obtained the file used in the actual attacks.
Apple credited Meta Product Security with reporting the flaw. Calif initially suggested WhatsApp as a possible delivery route, then withdrew that claim.
WhatsApp hasn’t published an advisory connecting its app to this vulnerability, and Meta hasn’t confirmed that connection. Whether the actual attack could work without a tap or click remains unconfirmed.
Apple first patched the flaw on September 28 in iOS 26.7.1 and iPadOS 26.7.1, along with macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Although the bug also affects iPads and Macs, Apple’s statement about possible exploitation applies specifically to iOS.
For iPhone users, the practical step is to install the latest software available under Settings > General > Software Update. The supplied update guidance lists iOS 26.7.1 or later, including October’s newer 26.7.2 build, for iPhone 11 and later. The October 26 fix for iPhone XS, XS Max, and XR is iOS 18.7.11. iOS 27 isn’t affected by this particular flaw.
Apple’s separate spyware threat notifications don’t serve as an alert for this vulnerability. Updating closes the security hole, but it doesn’t establish whether a device was previously targeted.
Thanks for reading. Follow Thought Catalog on Facebook for more stories like this, or explore our website.