Small Town Sysadmin
Free CJIS checklist

Tech basics

Security alert

Update iPhones, iPads, and Macs now: Apple fixed an exploited flaw in how images and files are processed

Apple patched a flaw it says was exploited in a targeted attack, and CISA lists it as exploited. Here is who needs to update, to which version, and how.

If your office uses iPhones, iPads, or Macs, check that they are fully updated this week. On September 28, 2026, Apple released fixes for a flaw in CoreGraphics, the part of the system that draws images and documents. Apple says that opening a maliciously crafted file could let an attacker run their own code on the device, and that it is aware of a report that the flaw was exploited in an attack. The Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on September 29, 2026.

Apple describes the attack as extremely sophisticated and aimed at specific targeted individuals, so most offices are not the likely target. Updating is still the right move: it takes a few minutes per device, and public sector and bank offices are often held to a patching deadline anyway.

The details

  • CVE: CVE-2026-86950, an out-of-bounds write (a program writing data outside the space it was given) in CoreGraphics.
  • Effect: processing a crafted file may lead to arbitrary code execution, meaning the attacker’s code runs on the device.
  • Exploitation: Apple says it is aware of a report of exploitation in an extremely sophisticated attack against specific targeted individuals. CISA lists it in KEV.
  • CISA due date: October 13, 2026 for federal agencies. CISA lists known ransomware use as “Unknown.”

What to update to

Apple’s security notes list these fixed versions, all released September 28, 2026:

Device Update to
iPhone 11 and later, and supported iPads iOS 26.7.1 or iPadOS 26.7.1 (or newer)
Mac running macOS Tahoe 26 macOS Tahoe 26.7.1 (or newer)
Mac running macOS Sequoia 15 macOS Sequoia 15.8.1 (or newer)

As of October 8, 2026, Apple’s security releases page shows the newest versions as iOS and iPadOS 27.0.1 and macOS Golden Gate 27.0.1, both released September 28. Apple lists no published CVE entries for those two updates, and its notes for this flaw describe exploitation on iOS versions before iOS 27. If a device can run version 27, updating to it is also fine. Apple’s three notes for this flaw cover only the versions in the table. A Mac on an older macOS, such as Sonoma 14, isn’t mentioned in them, so check Apple’s security releases page, and if the Mac can’t move to a supported macOS, plan to replace it.

How to update

iPhone or iPad (Apple’s steps):

  1. Plug the device in and connect it to Wi-Fi. Back it up first if it holds anything you can’t replace.
  2. Open Settings, tap General, then tap Software Update.
  3. If an update is shown, tap Download and Install and follow the prompts.

Mac:

  1. Choose System Settings from the Apple menu, click General, then click Software Update.
  2. Click the button to update or restart now. You may be asked for the password you use to log in to the Mac.
  3. Leave the Mac plugged in and awake until it finishes. It may restart several times.

If you can’t tell which version a device runs, the same Software Update screen shows it. If it says the device is up to date, you are done.

Make it automatic

On an iPhone or iPad, Settings > General > Software Update > Automatic Updates lets you turn on Automatically Install, which installs updates overnight while the device is charging and on Wi-Fi. Apple says turning on automatic updates is the best way to be sure a device gets security updates. On a Mac, the Software Update settings control whether updates install automatically.

For the person who manages the devices

  • If you use mobile device management (MDM) software, check its report for devices below the versions above and push the update.
  • Count work phones and Macs, and the personal phones staff use for email or two-step sign-in. An old, unpatched phone is also where your authenticator app lives. Our two-step sign-in guide explains why that matters.
  • Record the date you confirmed the updates. Auditors and cyber insurers ask how quickly you patch. The cyber insurance questionnaires guide covers what they ask.
  • Phones too old to take the update are a replacement item. Confirm any patching-timeline requirement with your CJIS Systems Agency, examiner, or counsel rather than relying on this article.
  • Flaws like this are triggered by opening a bad file, so staff training helps too. Our guide to spotting scam emails covers the lures.

Sources

All articles