Back Infosecurity-Magazine Apple Patches CoreGraphics Zero Day Exploited in Attacks
Apple has issued a security update designed to fix a zero-day vulnerability which it claimed may have been exploited in an “extremely sophisticated” attack.
In a bulletin on September 28, the tech giant attributed the discovery of CVE-2026-86950 to the Meta Product Security team.
“Processing a maliciously crafted file may lead to arbitrary code execution,” it said of the flaw.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Apple said the vulnerability affects the CoreGraphics rendering framework in iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 are also thought to be affected.
Cobalt CISO, Andrew Obadiaru, argued that security leaders should use the security warning to revisit device governance, especially for senior executives who often get exceptions from standard policy.
“I'd encourage teams to use this as a prompt to review three things,” he said.
“How quickly can you enforce a mobile OS update across your fleet, and who is allowed to defer it? Do you have a defined list of high-risk individuals with stronger device protections enabled? And if one of those phones were compromised, would your incident response plan know what to do with it? Many IR playbooks still stop at the laptop.”
The Latest in a Long Line of Zero Days
While high-value executives may have been a target for exploitation of this zero day, discoveries in the past have been tied to commercial spyware makers that tout exploits to governments and law enforcement agencies.
In February 2025, for example, researchers at The Citizen Lab found CVE-2025-24200, which Apple said had been exploited “in an extremely sophisticated attack against specific targeted individual.”
Apple this month also patched CVE-2026-86869, a critical zero-click vulnerability which could have been silently triggered via a maliciously crafted iMessage. It appears that this one was found and reported to the iPhone giant before malicious researchers had a chance to discover and monetize/weaponize it.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple Mitigates “Extremely Sophisticated” Zero-Day Exploit News 11 February 2025
Apple Mitigates “Extremely Sophisticated” Zero-Day Exploit
Apple Patches Actively Exploited iOS Zero-Days News 1 December 2023
Apple Patches Actively Exploited iOS Zero-Days
Firm Offers $2m for iOS Zero-Day Exploits News 9 January 2019
Firm Offers $2m for iOS Zero-Day Exploits
WhatsApp Patches Zero-Day, Zero-Click Flaw News 1 September 2025
WhatsApp Patches Zero-Day, Zero-Click Flaw
Apple Releases Patch for Likely Exploited Zero-Day Vulnerability News 22 August 2025
Apple Releases Patch for Likely Exploited Zero-Day Vulnerability
What’s Hot on Infosecurity Magazine?
Regulating AI: Where Should the Line Be Drawn?
Japanese Railway Operators Hit with Weekend Cyber Attacks
Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
US: Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules
Deepfakes Are Becoming a Costly Reality for Businesses, Report Warns
Citrix Patches Critical Zero Days Under Active Exploitation
Who Authorized That Agent? Enforcing AI Authority Before the Action
Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records
US: Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules
ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day
AI Security Awareness is the New Frontline of Cybersecurity
CISA Charts New "Quality Era" for Global CVE Program
Your Security Awareness Programme Isn't Failing, It's Just Not Relevant
From APIs to Agents: How to Secure AI at Enterprise Scale
Frontier AI: How Cyber Defenders Can Harness the Defender’s Window
Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology
Why Resilience‑Focused Cloud Design Is Your Best Defense Against Modern Attacks
Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser
How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies
Researchers Claim First Fully Agentic Ransomware: JadePuffer
AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?
Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses
How World Cup Password Trends Can Increase Active Directory Risk
New CISA Guide Helps Agencies Adopt SASE For Zero Trust
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
