Covered by 2 outlets — first reported by BleepingComputer, Oct 27, 10:36 UTC
Apple backports CoreGraphics zero-day patches to older iPhones
Summary
Apple has backported security patches, first released last month, to older iPhones and iPads to fix a zero-day (a flaw exploited before a fix existed) in CoreGraphics, according to BleepingComputer and The Hacker News. BleepingComputer says the bug was exploited in what Apple called extremely sophisticated targeted attacks. The Hacker News tracks it as CVE-2026-86950, rated CVSS 8.8, an out-of-bounds write that could allow arbitrary code execution when a maliciously crafted file is processed.
AI summary by the SecurityTabs newsroom, checked against BleepingComputer, The Hacker News. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
BleepingComputerFirst report
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
The Hacker News
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.