If you still use an iPhone XS, XS Max or XR, update it today. iOS 18.7.11, released October 26 alongside iOS 27.2, patches a CoreGraphics flaw that Apple says may have been used in a real attack. Newer iPhones on iOS 26 got the same fix a month ago. The older phones are getting it only now.

Apple also released iOS 26.7.2 for anyone with an iPhone 11 or later who has not moved to iOS 27 yet. That one does not mention an active attack, but it carries 134 security fixes, which is a lot for a point release. Here is what each update fixes, who should install which one, and how to get it.

iOS 18.7.11 (Build 22H384)

iOS 18.7.11 is for the iPhones that cannot run iOS 26: the iPhone XS, iPhone XS Max and iPhone XR. iPadOS 18.7.11 covers the iPad 7th generation, and Apple also lists it for the iPad Air 4th generation and later, the iPad 9th generation and later, and the iPad mini 6th generation and later. It contains three security fixes and no new features.

The CoreGraphics Flaw Apple Says Was Exploited

CoreGraphics is the part of iOS that draws images and text. The bug, CVE-2026-86950, is an out-of-bounds write, which means a specially made file could write past the memory it was given and run code on your phone. Apple's security notes say it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27. Meta Product Security reported it.

Apple fixed this exact flaw for iPhone 11 and later in iOS 26.7.1 on September 28, with no other fixes in that update. iPhone XS and XR owners were left without it for four weeks, until iOS 18.7.11. "Extremely sophisticated" and "targeted individuals" usually point to attacks aimed at a small number of people, not a mass campaign, and Apple has not said who was targeted. Once a fix is public, though, the details of a bug are easier for others to work out, so there is no reason to wait.

Camera and Audio Fixes

The other two fixes close holes a malicious app could use. CVE-2026-86990 in CoreMedia could let an app turn on the camera without your permission. CVE-2026-65339 in Audio could let an app leak sensitive information. Neither has a report of being exploited.

iOS 26.7.2

iOS 26.7.2 is for iPhone 11 and later, plus the matching iPads, for anyone staying on iOS 26 for now. If you have held off on iOS 27 because of its early bugs, this is how you stay patched in the meantime. It already includes the CoreGraphics fix from iOS 26.7.1, so if you skipped that update, this one covers it.

134 Fixes, Led by Safari and the Kernel

Apple's notes list 134 fixes. WebKit, the engine behind Safari and every in-app browser, accounts for 26 of them, and several could let a malicious website run code. Another 16 are in ImageIO, which opens photos and image files, and 14 are in the kernel, the core of the system.

A few stand out because they involve things you might expect to be locked down:

  • A Siri bug could let someone holding your phone see your contacts from the Lock Screen (CVE-2026-84614).
  • A malicious app could reach the camera without permission (CVE-2026-86990), the same fix iOS 18.7.11 got.
  • A local attacker could get at items in your Keychain, where passwords are stored (CVE-2026-28864).
  • A website could use a media format that Lockdown Mode is supposed to block (CVE-2026-113952).

Apple does not say any of the 134 were exploited.

What If You Are Already on iOS 27?

Nothing to do here. Apple says the CoreGraphics attack worked on versions before iOS 27, and iOS 27.2, released the same day, carries its own long list of security fixes. If you have not installed 27.2 yet, see our iOS 27.2 guide and the Should I Update? call for every version.

How to Install

Open Settings, tap General, then Software Update. On an iPhone XS or XR, iOS 18.7.11 is the only update offered. On an iPhone 11 or later still running iOS 26, Software Update shows both iOS 26.7.2 and the iOS 27 upgrade. Choose iOS 26.7.2 if you want to stay on iOS 26.

To get future fixes like this without thinking about it, go to Settings, General, Software Update, Automatic Updates, and turn everything on.

Still using an iPhone XS or XR? Tell us in the comments what is keeping you on it.