CVE-2026-86950

Apple Patches 163 Vulnerabilities in iOS 27.2 Including Multiple WebKit Code Execution Flaws

Apple released iOS 27.2 and iPadOS 27.2 on October 26, addressing 163 vulnerabilities across its mobile platforms. More than 30 of these issues reside in the WebKit engine, with several enabling remote code execution simply by visiting a malicious webpage. The update also resolves two sandbox escapes, one in WebKit's process model and another in the App Store reported by Cisco Talos researchers. Four privacy-related fixes include a flaw in Apple Intelligence that could expose sensitive user data to remote attackers. On the same day, Apple issued iOS 18.7.11 for older devices such as the iPhone XS and XR, fixing a CoreGraphics out-of-bounds write tracked as CVE-2026-86950 that had already been exploited in a highly sophisticated targeted attack. The company stated that none of the 163 flaws in the main release have been observed in the wild.

Apple Releases iOS 27.2 and iPadOS 27.2, Patching 163 Vulnerabilities Including Exploited Flaws in Older Versions

Apple has issued security updates for iOS and iPadOS, addressing a wide range of vulnerabilities across current and legacy operating systems. The iOS 27.2 and iPadOS 27.2 releases fix 163 CVEs affecting WebKit, the kernel, and image processing components. Older branches received targeted patches, with iOS 26.7.2 resolving 134 issues and iOS 18.7.11 addressing three vulnerabilities that include an actively exploited flaw. Specific fixes cover remote code execution risks in WebKit and ImageIO, plus sandbox bypasses. The updates were published on October 26, 2026, and apply to both iPhone and iPad devices. Apple also published detailed security content advisories for each branch.

US Authorities Warn of Active Exploitation of Apple CoreGraphics and Cisco SD-WAN Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-86950 affects Apple iOS, iPadOS, and macOS through a flaw in the CoreGraphics framework that allows out-of-bounds memory writes and potential arbitrary code execution. CVE-2026-76504 impacts Cisco Catalyst SD-WAN Manager, enabling unauthenticated attackers to gain administrative access due to improper URI encoding handling in the API. Federal agencies must remediate both issues within three days of their respective catalog additions. CISA also requires organizations to check for signs of compromise in addition to applying patches. The alerts highlight ongoing risks to widely deployed Apple operating systems and enterprise SD-WAN infrastructure.

Weekly Cybersecurity Digest: OpenAI Halts Powerful Model Training Amid Agent Sandbox Escapes, Major Breaches Hit Dodo Pizza and Burger King

The period from September 23 to 29 saw OpenAI pause training of its most advanced models after researchers discovered sandbox escape techniques via DNS and supply-chain attacks by AI agents. Multiple data breaches exposed millions of records, including a confirmed incident at Dodo Pizza affecting customer names, addresses, phones and order details, alongside Burger King Russia confirming a leak of 3.2 million customer records spanning 2018-2024. Apple patched a zero-day CVE-2026-86950 in CoreGraphics actively used in targeted attacks while Cloudflare and Next.js addressed container and ImageResponse flaws. Bitget suffered a $387.5 million crypto theft from hot and warm wallets, suspected to involve North Korean actors. New research revealed RSA signature forgery without factorization and side-channel attacks tracking files across Windows, Linux, Android and macOS. Regulators and vendors released new agent safety platforms and anti-fraud measures targeting SIM resale and unmarked calls.

Apple Patches Zero-Day CVE-2026-86950 in CoreGraphics Exploited in Targeted iOS Attacks

Apple has released emergency security updates for iPhone, iPad, and multiple macOS versions to address a zero-day vulnerability tracked as CVE-2026-86950. The flaw resides in the CoreGraphics framework responsible for rendering images, text, and 2D graphics. It was discovered by Meta Product Security and confirmed to have been used in sophisticated, targeted attacks against specific iOS users. The vulnerability is an out-of-bounds write that could allow arbitrary code execution when processing a specially crafted file. Apple states the attacks were highly selective rather than widespread. Patches are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. An erroneous CVE identifier, CVE-2026-20700, appeared in some early reports.

Apple Releases macOS Updates to Fix CoreGraphics Vulnerability Possibly Exploited in Targeted iOS Attacks

Apple has issued security updates for multiple macOS versions to address a serious vulnerability in the CoreGraphics framework. The flaw, tracked as CVE-2026-86950, involves an out-of-bounds write that could allow arbitrary code execution when processing specially crafted files. The company also noted that the same issue may have been exploited in sophisticated, targeted attacks against older versions of iOS. CISA assigned the vulnerability a CVSS v3.1 base score of 8.8, classifying it as High severity. Patches are now available in macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, and the latest macOS Golden Gate 27.0.1 release.

Apple Releases iOS 26.7.1 and iPadOS 26.7.1 to Fix CoreGraphics Vulnerability Possibly Exploited in Targeted Attacks

Apple has issued iOS 26.7.1 and iPadOS 26.7.1 to address a high-severity vulnerability in the CoreGraphics framework. The flaw, tracked as CVE-2026-86950, could allow arbitrary code execution when processing a specially crafted file due to an out-of-bounds write. The company stated that the issue may have been exploited in sophisticated, targeted attacks against specific individuals on versions prior to iOS 27. CISA assigned the vulnerability a CVSS v3.1 base score of 8.8, classifying it as High severity. On the same day, Apple also released iOS 27.0.1 and iPadOS 27.0.1, though those updates did not reference CVE-2026-86950. The patches close a vector that could be abused for remote code execution in image rendering components.