Security Patch for Older iPhones Arrived a Month Late

Apple fixed a security flaw that could have been exploited in targeted hacker attacks on older iPhones about a month late. The update in question is iOS 18.7.11 and iPadOS 18.7.11, released on October 26 local time in the United States, designed to protect older devices that cannot install the latest operating system (a device's core software). The patch targets the iPhone XS, iPhone XS Max, iPhone XR, and the seventh-generation iPad.

Apple first fixed the flaw on September 28 in iOS 26.7.1 and other updates, and this update extends that fix to devices that cannot run iOS 26. It is what is known as a backport, applying the fixes from a newer version to an older one.

The flaw in question is a vulnerability (CVE-2026-86950) in the CoreGraphics framework, which processes graphics, images, and PDF content. The flaw is an out-of-bounds write, an error in which software writes data outside its allocated memory. Apple explained that "processing maliciously crafted files may lead to arbitrary code execution." Its severity score is 8.8 (high).

In its security advisory, Apple said it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS prior to iOS 27. Apple did not disclose the victims, who was behind the attack, or how the files were delivered.

Users of older iPhones and iPads that cannot upgrade to the latest operating system can protect themselves from the flaw while staying on the existing iOS 18 series by installing the iOS 18.7.11 update. The update can be installed via Settings, General, and Software Update.