Apple releases iOS 26.7.1 and macOS security updates for older supported devices

Macworld If you haven’t gotten around to updating your iPhone or Mac to OS 27, Apple hasn’t forgotten about you. Alongside iOS 27.0.1 and macOS 27.0.1 on Monday, Apple also released an update for older devices that can’t or don’t want to take the leap to OS 27. You won’t get any new features, but the update patches a pretty serious security flaw for iOS 26, Tahoe, and Sequoia devices. According to Apple’s Security Updates page, 26.7.1 and 15.8.1 for macOS Sequoia contain a single CVE entry that is known to have been exploited: CoreGraphics Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86950: Meta Product Security The phrase “extremely sophisticated attack” means most users don’t have to worry. It has historically been used to describe flaws that were exploited to target specific groups of people, such as government officials or journalists. The flaw appears to have been patched ahead of the OS 27 releases, as it is not included in the original release nor as part of the 27.0.1 updates that arrived on Monday.  To update your devices, head over to System Settings (on a Mac) or Settings (on anything else), select General and then Software Update, and follow the prompts.

iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 address a major vulnerability that Apple believes was used against a small number of people. Apple's security support pages say there was a CoreGraphics out-of-bounds write issue that could be exploited with a maliciously crafted file, allowing for arbitrary code execution. It has been fixed with improved bounds checking. Apple says the flaw was exploited in an "extremely sophisticated attack" on targeted individuals running older versions of iOS. Apple's latest operating systems don't appear to be affected, and the iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1 updates that came out today have no published CVE entries. While the attack wasn't widespread, if you're still running a version of iOS 26, iPadOS 26, macOS Tahoe, or macOS Sequoia, you should install the new updates as soon as possible. Now that the vulnerability is public, it could be further exploited against users who aren't protected.Related Roundups: iOS 26, iPadOS 26Related Forum: iOS 26This article, "iOS 26.7.1 Fixes Vulnerability Used in Targeted Attacks" first appeared on MacRumors.comDiscuss this article in our forums