Apple patches older iPhone XS and XR against a flaw possibly used in targeted attacks
Released October 26, iOS 18.7.11 fixes, on devices stuck on iOS 18, a flaw patched in September on newer versions. Here are the affected models and how to install the update.
Translated from French by AI. The original French article is the reference version.
On October 26, Apple released iOS 18.7.11 and iPadOS 18.7.11, updates for devices that cannot move beyond iOS 18. They fix the vulnerability CVE-2026-86950. Apple says it received a report that this flaw may have been exploited in an "extremely sophisticated" attack against targeted individuals running versions of iOS older than iOS 27.
The flaw is in CoreGraphics, the component that draws text, images and graphics on screen. It is an out-of-bounds write. According to Apple, processing a malicious file could allow code to be executed on the device. It was discovered by Meta's product security team.
A fix available since September, but not for everyone
According to BleepingComputer, Apple had already fixed this flaw in September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Devices that cannot move beyond iOS 18 therefore remained exposed. This is the case for the iPhone XS, XS Max and XR, which iOS 26 no longer supports.
On the tablet side, the update only targets the 7th-generation iPad, which iPadOS 26 no longer supports: newer iPads received this fix in September with iPadOS 26.7.1.
It fixes two other flaws, with no reports of exploitation. One, in the audio component, could allow an app to disclose sensitive information. The other, in CoreMedia, could allow a malicious app to access the camera without permission.
Should you be worried?
Apple describes an attack against targeted individuals. This type of operation usually goes after a few specific profiles, not the general public. Such profiles exist in France too, as the case of the spyware that targeted the iPhone of former minister Agnès Pannier-Runacher showed. And once a patch is released, other attackers can study it to find the flaw and exploit it.
How to install the update
- Open Settings, then General and Software Update, and install iOS 18.7.11 or iPadOS 18.7.11.
- If your iPhone or iPad supports a more recent version of the system, installing the latest available version also fixes this flaw.
- In a company, use your mobile device management tool to identify devices still running iOS 18: they are often old work phones that are easily forgotten.
One question remains for owners of the iPhone XS and XR, released in 2018: how long will Apple keep fixing their vulnerabilities?
Method: AI-assisted monitoring, facts verified by a second AI model, article published automatically then reviewed and approved by Frédéric LENQUETTE on November 12, 2026. Our editorial policy.
Share this article
