Apple patched an iPhone flaw attackers may already have exploited. Here’s how the attack works

Apple has patched an iPhone security flaw that may already have been used in an “extremely sophisticated” attack against specific individuals.

Tracked as CVE-2026-86950, the bug affects CoreGraphics, the framework iOS uses to render visual content. A specially crafted file can corrupt memory and potentially give an attacker a foothold on the device.

Apple fixed the flaw in iOS 26.7.1 and iPadOS 26.7.1 on September 28. Anyone still running an affected version of iOS should install the update.

How the attack works

CoreGraphics handles visual content deep inside iOS. The vulnerability can trigger an out-of-bounds write, causing the system to place data somewhere in memory it shouldn’t.

That kind of memory corruption can potentially be turned into arbitrary code execution. In simpler terms, a malicious file could make the device run code controlled by an attacker.

We still don’t know how attackers delivered the file or whether victims had to interact with it. There also isn’t enough public information to describe this as a zero-click attack or claim that simply receiving an image or message could compromise an iPhone. Other documented campaigns have used sophisticated iPhone hacking techniques, but there’s no evidence this attack worked the same way.

What Apple still hasn’t explained

Apple hasn’t disclosed the exact file type used in the attacks or whether CVE-2026-86950 was combined with other vulnerabilities as part of a larger exploit chain.

What it has said is unusually specific about the targets. The attacks involved particular individuals rather than widespread exploitation of everyone running an older version of iOS. Apple’s Lockdown Mode is designed for people who face this kind of highly targeted threat.

Meta Product Security reported the vulnerability, but there’s no public evidence connecting the attack to WhatsApp, Instagram, or another Meta service. Any such connection would still be speculation.

What iPhone users should do now

Anyone staying on iOS 26 should install iOS 26.7.1 rather than waiting for the full technical story to emerge. Apple has also continued providing security updates for older iPhones, so keeping supported devices patched remains the safest move.

The vulnerability was also patched on Mac, but Apple’s exploitation warning specifically refers to targeted attacks against iPhone users running versions of iOS before iOS 27.

There’s no sign this was a mass campaign aimed at ordinary iPhone owners. Updating is still the sensible move because Apple believes the flaw may already have been exploited, and the delivery method remains unknown.