Apple Patches Graphics Bug in iOS 26 That May Have Been Used in Targeted Attacks

Apple released an urgent security update for iOS 26, iPadOS 26 and macOS 26 fixing CVE-2026-86950, a bug in the core graphics engine. Apple said the flaw "may have been exploited" in "an extremely sophisticated attack against specific targeted individuals," without confirming whether attacks took place. Meta's product security team discovered and reported it.

Graphics engines have broad system access, so a successful exploit could let attackers steal wide swaths of personal data. iOS 27, iPadOS 27 and macOS 27, released earlier in September, are not affected.

The urgency is high because roughly 80% of iPhone users are still on iOS 26. The report also notes a separate zero-click flaw, CVE-2026-86869, found by Belgian firm ironPeak, which could be triggered via a malicious iMessage and bypass Apple's BlastDoor protection.