Apple patches CoreGraphics zero-day already exploited in targeted attacks

Meta-spotted flaw could hand attackers arbitrary code execution via a maliciously crafted file

Apple buried Copland 30 years ago. Now the failed OS boots in a browser 2 days ago

Apple buried Copland 30 years ago. Now the failed OS boots in a browser

Asahi fork embraces LLMs and lands Linux on the M4 Mac mini 4 days ago

Asahi fork embraces LLMs and lands Linux on the M4 Mac mini

Meta's new AI fidget is a ... Tamagotchi? 4 days ago

Meta's new AI fidget is a ... Tamagotchi?

iPhone 18 Pro benchmark boosted by giving it a cold drink 4 days ago

iPhone 18 Pro benchmark boosted by giving it a cold drink

Meta ads steered Polish Android users into a premium-rate billing trap 5 days ago

Meta ads steered Polish Android users into a premium-rate billing trap

Apple has patched a CoreGraphics zero-day after warning that attackers may already have used the bug to compromise a small number of carefully chosen targets.

The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write flaw in CoreGraphics, Apple's framework for handling graphics across its operating systems.

According to Apple's advisory, processing a maliciously crafted file could allow an attacker to execute arbitrary code on a vulnerable device. The fruity vendor said it addressed the problem with improved bounds checking, though the bug appears to have made it out into the wild before Apple could squash it.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," the company said.

As is customary when Cupertino encounters the sort of security bug somebody has apparently found useful, further details are thin on the ground. Apple didn't say who was targeted, how many people were affected, who was behind the attacks, or exactly how the vulnerability was being exploited.

However, its choice of words suggests this wasn't a bug being exploited indiscriminately across the internet, and raises the possibility that it was used as part of a targeted spyware campaign.

Meta Product Security reported CVE-2026-86950 to Apple, but neither Apple's advisory nor Meta has provided further technical details on how the flaw was discovered or the attacks in which it was allegedly used.

The fix landed on Monday in iOS 26.7.1 and iPadOS 26.7.1. Apple lists affected devices receiving the update as the iPhone 11 and later, iPad Pro 12.9-inch (third generation and later), iPad Pro 11-inch (first generation and later), iPad Air (third generation and later), iPad (eighth generation and later), and iPad mini (fifth generation and later).

Apple specifically says the attacks hit devices running versions of iOS before iOS 27, though it hasn't said exactly which older releases were targeted.

The flaw adds another entry to Apple's growing collection of vulnerabilities caught being abused before users had a patch, with CVE-2026-86950 landing as the seventh zero-day fixed by the company this year.

For anyone still running the affected releases, that leaves the usual less-than-thrilling security advice: install the update rather than waiting to find out exactly what an "extremely sophisticated attack" looks like. ®

Apple patches CoreGraphics zero-day already exploited in targeted attacks

Meta-spotted flaw could hand attackers arbitrary code execution via a maliciously crafted file

OpenAI benches GPT-6.1 Astra for overstepping the mark

Turns out teaching an AI to keep going can make it rather bad at knowing when to stop

Huawei Cloud Rolls Out Enterprise AI Products Across the Board, Building an Open Agentic Cloud

PARTNER CONTENT: Huawei Cloud strengthens the silicon bedrock on the cloud

Leaked IPO docs: Anthropic tempts investors with existential risk warning

Just wait until you hear the bad news

Open source datacenters and open source thinking will undo self-inflicted DC damage

Denial and distraction have served the bit barn barons very badly. Wise up

Investors are pricing in a 32.6% AI productivity boost for software engineers

Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

UPDAted Register reader hit with surprise bill after Microsoft portals disagreed

Register reader hit with surprise bill after Microsoft portals disagreed

EXCLUSIVE Microsoft tells nonprofits their deleted M365 data isn't coming back

Microsoft tells nonprofits their deleted M365 data isn't coming back

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

Investors are pricing in a 32.6% AI productivity boost for software engineers Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away

Investors are pricing in a 32.6% AI productivity boost for software engineers

Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away

AMD bets $8.2B that worlds matter more than words in AI AI pioneer Fei-Fei Li just co-founded spatial AI research company World Labs in 2024. Now it's joining AMD

AMD bets $8.2B that worlds matter more than words in AI

AI pioneer Fei-Fei Li just co-founded spatial AI research company World Labs in 2024. Now it's joining AMD

AWS needs to embrace its place as the Depot of AI infrastructure What's wrong with being a great wholesaler?

AWS needs to embrace its place as the Depot of AI infrastructure

What's wrong with being a great wholesaler?

French dev aims to solve bots' blindness so they can understand GUIs Because sometimes escaping your sandbox requires clicking a button

French dev aims to solve bots' blindness so they can understand GUIs

Because sometimes escaping your sandbox requires clicking a button

OPINION Open source datacenters and open source thinking will undo self-inflicted DC damage Denial and distraction have served the bit barn barons very badly. Wise up

Open source datacenters and open source thinking will undo self-inflicted DC damage

Denial and distraction have served the bit barn barons very badly. Wise up

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user

KDE turns 30 and someone's brought an AI-native desktop proposal

Akademy talk imagines Plasma assembling itself around a personal model of each user

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term '

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line

Acquisition gives open source CSS framework 'a stable long-term '

Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push

Switzerland tests a FOSS escape route from Microsoft 365

Swiss Army sticks a knife in American cloud apps with its own FOSS push

Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin

Feel peak Windows was 7? You might like Kumander Linux

Debian and Xfce – solid, sensible choices – with a pretty skin

Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted

Canonical shuttering some of its legacy chat channels

The Ubuntu Pastebin went in June, IRC gets demoted

Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Audacity audio-editing app no longer looks like it's from the early 2000s

The FOSS tool for audio editing has a fresh coat of paint, and new features to boot