Apple’s latest operating-system updates address 286 security flaws across iOS, iPadOS and macOS, while a separate legacy release brings an exploited CoreGraphics fix to older iPhones and iPads. Apple published iOS 27.2, iPadOS 27.2 and macOS Golden Gate 27.2 on October 26, alongside iOS 18.7.11 and iPadOS 18.7.11 for devices that cannot move to newer major releases.
The main updates cover iPhone 11 and later, several recent iPad families and Macs running Golden Gate. Security researchers’ tally of Apple’s advisories puts the release at 163 fixes for iOS and iPadOS and 263 for macOS, with overlapping components producing a combined total of 286 vulnerabilities. The fixes span memory-corruption issues in WebKit, the kernel and code responsible for processing images, fonts, PDFs, audio and video. Several could permit arbitrary code execution if an attacker successfully induced a victim to process malicious content.
The urgent separate issue is CVE-2026-86950, an out-of-bounds write in Apple’s CoreGraphics framework. Apple says processing a maliciously crafted file could lead to arbitrary code execution and acknowledges a report that the flaw may have been exploited in an “extremely sophisticated attack” against specific targeted individuals on iOS versions before iOS 27. Meta Product Security is credited with discovering the vulnerability.
The National Vulnerability Database has not assigned its own CVSS score, but its CISA enrichment records a CVSS 3.1 score of 8.8, rated high, with a vector indicating network reachability, no required privileges and possible impacts to confidentiality, integrity and availability. The CISA Known Exploited Vulnerabilities catalog is the authoritative U.S. government list for vulnerabilities confirmed as exploited in the wild; the exploitation warning in Apple’s advisory is the more specific public evidence for this incident. No public proof-of-concept or threat-actor attribution has been established in the available advisories.
Apple previously fixed CVE-2026-86950 in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The October backport extends protection to the iPhone XS, XS Max and XR, plus the seventh-generation iPad. Administrators should prioritize installing iOS 27.2 or the applicable macOS release on supported systems and deploy iOS 18.7.11 or iPadOS 18.7.11 on legacy hardware, particularly where users regularly open files or links from untrusted sources.
