Back Feeds.Feedburner

Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’

Feeds.Feedburner •Eduard Kovacs • September 29, 2026

Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.

The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.

Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory.

No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned the vulnerability from Meta’s product security team.

Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.

It’s unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp. SecurityWeek has reached out to Meta for clarification and will update this article if the company responds.

CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .

While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.

CISA has yet to add CVE-2026-86950 to its KEV catalog . This would be the ninth Apple product flaw added to the catalog this year.

Related : Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

Related : Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari

Related : Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks Apple has released emergency updates for iOS, iPadOS, and macOS to address a critical zero-day vulnerability, CVE-2026-86950, in its CoreGraphics framework. This out-of-bounds write flaw can allow arbitrary code execution when a device processes a maliciously crafted file. The vulnerability was reportedly exploited in highly sophisticated attacks against specific individuals using versions of iOS prior to iOS 27. Meta Product Security reported the issue to Apple, which has not disclosed details about the targeted individuals or the attack methods used. The flaw affects a range of devices, including iPhone 11 and later, and various iPad models. Apple released patches on September 28, 2026, and users are urged to update their devices immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, emphasizing the urgency of the situation. 32 sources 73

Extracted Entities

Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

CWE Weaknesses (1)

Platforms (2)