India’s federal cyber emergency body has told the country’s Apple owners to install updates it rates as a high-severity risk, but it produced no vulnerability identifiers to go with the warning.
The advisory, logged by the Indian Computer Emergency Response Team as CIAD-2026-0056, covers the operating systems Apple shipped on October 26 and names version cutoffs rather than affected components. Anyone behind those cutoffs sits inside the exposure window.
The floor for phones and tablets is iOS and iPadOS 18.7.11, 26.7.2 or 27.2 depending on hardware. Macs need Sequoia 15.8.2, Tahoe 26.7.2 or Golden Gate 27.2. Safari has to reach 27.2, and the television, watch and headset platforms all require 27.2.
The notice describes what an attacker gets rather than what the bugs are. Depending on which weakness is reached, outcomes run from running unauthorised code and lifting privileges to reading sensitive information and stepping past built-in restrictions. Memory corruption and buffer overflow are named as the underlying classes.
Delivery is the familiar route. A victim has to open a malformed file, image, audio clip or video, or load a page built to trigger the fault. That makes the advisory less a hunt for one hole than a reminder that the whole October stack matters.
India’s agency has leaned on version floors before rather than CVE lists, and the pattern leaves defenders unable to prioritise. A company that cannot patch every device in one pass has no signal about which fix closes the worst exposure.
Apple’s October 26 releases carried hundreds of entries, including a CoreGraphics flaw near the top of the pile. The warning does not say which of those matters most. Installing any build at or above the published floor is the only practical answer, and hardware too old to reach them is left outside the remedy entirely.
