Owners of the oldest iPhones Apple still patches have finally received a fix for a file-handling bug the company says has already been used against real people.
The iOS 18.7.11 and iPadOS 18.7.11 builds landed on October 26, reaching iPhone XS, XS Max and XR plus the seventh-generation iPad. All four sit below the iOS 26 hardware floor, so this branch was their only route to a repair.
At the centre is CVE-2026-86950, an out-of-bounds write in CoreGraphics, the framework that draws images and documents. A malformed file pushed at the renderer could run attacker code. Apple tightened the bounds check, crediting Meta Product Security.
Why this matters more than a routine backport: the advisory carries an exploitation warning Apple normally reserves for its newest software. It says a report exists that the flaw was abused in an extremely sophisticated attack on specific targeted individuals, across versions of iOS released before iOS 27.
Two more defects travel alongside. CVE-2026-65339, an Audio logic slip, could let an app leak sensitive user information. CVE-2026-86990 in CoreMedia let a malicious app reach the camera without permission. Researcher Mustafa Calap, of dbg.re, is credited on both.
The same afternoon brought iOS 26.7.2 and iPadOS 26.7.2 for iPhone 11 and later, listing 134 entries with no exploited-in-the-wild flags. Mac users got Tahoe 26.7.2 and Sequoia 15.8.2, while Apple TV picked up tvOS 26.6.1, whose only visible change supports the fourth-generation Siri Remote on older boxes.
The practical reading: a handset that cannot run iOS 27 is not out of support, but it does depend on Apple choosing to backport. That choice was made this week. Leaving the update installed is the only thing standing between a crafted attachment and the code it carries.
