Apple patches 329 security flaws in one go – and finally brings older iPhones the fix for an exploited bug

On 26 October 2026 Apple updated practically its entire line-up. According to its overview of security releases, that day saw iOS 27.2 and iPadOS 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 18.7.11 and iPadOS 18.7.11, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. Xcode 27.2 for developers followed on 29 October.

The numbers are remarkable. On Apple's security page for iOS 27.2 we counted 163 distinct CVE entries on 2 November 2026, including 26 under the WebKit heading, 15 in the kernel and 11 in ImageIO. iOS 26.7.2 comes to 134 entries, iOS 18.7.11 to three. On the Mac side there are 263 entries for macOS Golden Gate 27.2, 213 for macOS Tahoe 26.7.2 and 197 for macOS Sequoia 15.8.2. Many flaws affect several systems at once and therefore appear on more than one page.

Once the duplicates are removed, 9to5Mac arrives at 329 distinct vulnerabilities across all of the day's updates and 1265 CVE entries in total on Apple's pages. The site points out that these figures may still rise, because Apple regularly adds to its security notes after release. MacRumors speaks of «more than 160» flaws for iOS 27.2 and notes that Apple does not report active exploitation for any of them.

What stands out, according to MacRumors and 9to5Mac, is who found the flaws: alongside traditional security researchers, Apple credits research teams at AI companies and AI tools as discoverers. According to MacRumors, six entries go back to the «Calif» team, which had previously jailbroken the iPhone Duo. For you as a user this mainly means that more flaws are being found and closed faster – provided you actually install the updates.

The most important news of the day is hidden in the smallest update. iOS 18.7.11 and iPadOS 18.7.11 for iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad contain only three entries, but one of them matters a great deal: CVE-2026-86950 in CoreGraphics, the graphics library that processes images and PDFs. According to Apple, processing a manipulated file could lead to the execution of foreign code – an out-of-bounds write that Apple fixed with improved bounds checking. Apple credits Meta Product Security with reporting the flaw.

Apple's own words are: «Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.» In plain terms, Apple has received a report that attackers may already have used this flaw against a small number of chosen people. Apple says nothing more – neither who was attacked nor by whom.

The flaw is not new. The same CVE number with the same wording already appears on Apple's security page for iOS 26.7.1, released on 28 September 2026 for iPhone 11 and later. The older devices, which according to MacRumors can no longer run iOS 26, therefore had to wait 28 days for the same fix. Apple does not say why. We note this without speculating.

Besides the CoreGraphics flaw, iOS 18.7.11 closes two more: CVE-2026-65339 in Audio, through which an app could, according to Apple, disclose sensitive user data, and the camera flaw CVE-2026-86990, which we come to in the next section. Going by the date shown, Apple's page for iOS 18.7.11 was only published on 29 October 2026, three days after the update itself.

Among the more than 160 entries for iOS 27.2, a few stand out because they touch the everyday life of private users directly. The most striking is CVE-2026-86990 in CoreMedia: according to Apple, a malicious app could access the camera without the user's permission – the permission prompt could be bypassed. The flaw is listed for iOS 27.2, iOS 26.7.2, iOS 18.7.11, macOS Golden Gate 27.2 and macOS Tahoe 26.7.2 (but not in the list for macOS Sequoia 15.8.2). Apple credits security researcher Mustafa Calap with reporting it. 9to5Mac puts it in context: the green dot on the iPhone, or the green LED on the Mac, still lit up, because the flaw only defeated the permission prompt, not the indicator. According to 9to5Mac, there is no evidence of exploitation.

Second, privacy: according to Apple, CVE-2026-112500 in Mail could reveal your real email address if you use the «Hide My Email» feature – precisely the address that feature is meant to protect. And CVE-2026-113952 in WebKit allowed a website, Apple says, to use a media format that should have been blocked in Lockdown Mode. Lockdown Mode is aimed at people who are particularly at risk; a flaw right there weighs more heavily than the number «one» suggests.

Third, the classics: several WebKit entries – for instance CVE-2026-112626, CVE-2026-112639, CVE-2026-112637 and CVE-2026-112659 – carry Apple's standard wording that processing manipulated web content may lead to the execution of foreign code. That is the building block attackers use to take over a device via a prepared web page; 9to5Mac recalls that the exploit kits «Coruna» and «DarkSword», whose flaws Apple closed this year, relied on exactly this kind of WebKit flaw. Add to that CVE-2026-86987 in Apple Intelligence (a remote attacker could, according to Apple, access sensitive user data; affects iPhone 15 Pro and later), CVE-2026-112652 in Security (an app could bypass certificate validation) and CVE-2026-112595 in Thread (attackers in physical proximity could gain access to the Thread network).

Two entries appear only in the older systems: in iOS 26.7.2 Apple lists CVE-2026-84614 in Siri, through which someone with physical access could retrieve contacts from the lock screen, and CVE-2026-28864 in Security, through which a local attacker could obtain keychain entries. macOS Tahoe 26.7.2 lists CVE-2026-43736 in Siri, through which an app could, according to Apple, access sensitive user data. Apple reports no exploitation for any of these flaws.

On the iPhone there are three routes. According to Apple, iOS 27.2 runs on iPhone 11 and later as well as on iPad Pro 12.9" from the 4th generation, iPad Pro 11" from the 2nd generation, iPad Air from the 4th generation, iPad from the 9th generation and iPad mini from the 6th generation. iOS 26.7.2 also runs on iPhone 11 and later, and on iPads one generation further back in each case (iPad Pro 12.9" from the 3rd generation, iPad Pro 11" from the 1st generation, iPad Air from the 3rd generation, iPad from the 8th generation, iPad mini from the 5th generation). It is intended for anyone who does not yet want to move to iOS 27 or whose iPad cannot. According to MacRumors, it contains many of the same security fixes; Apple's page lists 134 entries compared with 163 for iOS 27.2.

iOS 18.7.11 and iPadOS 18.7.11 are exclusively for iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad. These devices no longer receive iOS 26 and get only the three fixes described above – including the exploited CoreGraphics flaw and the camera flaw. If you own one of these devices, do not put the update off.

On the Mac the split mirrors the iPhone: macOS Golden Gate 27.2 for the current system, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2 for its two predecessors. Safari 27.2 (33 entries according to Apple, for macOS Sequoia and macOS Tahoe) brings the WebKit fixes to the two older Mac systems as well. Then there are watchOS 27.2 for Apple Watch Series 9 and later, tvOS 27.2 for Apple TV 4K from the 2nd generation and visionOS 27.2 for all Vision Pro models. tvOS 26.6.1 for Apple TV HD and the 1st-generation Apple TV 4K, also released on 26 October, is according to MacRumors a pure feature update with no security content.

Before you start, Apple advises you to back up your device using iCloud or your computer. Plug the device into power and connect it to Wi-Fi. Then, according to Apple's support page, proceed as follows on the iPhone or iPad: open «Settings», tap «General», then tap «Software Update». You will see the currently installed version of iOS and whether an update is available. Tap «Download and Install» and follow the onscreen instructions. Apple points out that VPN or proxy connections might prevent your device from contacting the update servers – so switch your VPN off briefly if necessary (→ How to set up a VPN on your iPhone – with an app or by hand).

Better still is not having to think about it at all. Under «Settings» > «General» > «Software Update» > «Automatic Updates», Apple offers two options: «Automatically Install» downloads and installs an update overnight while the iPhone is charging and connected to Wi-Fi; you receive a notification beforehand. «Automatically Download» only downloads the update in the background so that you can install it later – according to Apple, this option appears only when Automatically Install is switched off. Under «System Files» you can additionally turn on «Automatically Install», so that small security fixes are applied even without a version change.

On the Mac, according to Apple, the route is the Apple menu in the top-left corner > «System Settings» > «General» > «Software Update». The feature automatically checks for suitable software; if an update is available, click the button to update or restart. Here too Apple recommends a backup first, and here too you can use the «Software Update» settings to control whether your Mac downloads and installs updates automatically.

Switzerland's National Cyber Security Centre (NCSC, known in German as BACS) puts it this way on its page on device security: in particular, make sure your device is always kept up to date, as outdated software provides an entry point for cybercriminals – and make sure that all devices (computers, smartphones, tablets) automatically install available security updates. That is exactly what the «Automatically Install» option does.

What does Apple's phrase «extremely sophisticated attack against specific targeted individuals» mean for you? First of all: no reason to panic. Attacks of this kind are expensive and, experience shows, aimed at a small number of selected targets – Apple gives neither names nor numbers, and we do not know whether anyone in Switzerland was affected. But it is a clear reason to update. With the publication of the security notes, the details are out in the open, and MacRumors states the consequence soberly: devices that are not updated can now be attacked by anyone with the relevant skills – no longer only by those who found the flaw first.

That the older iPhones received the CoreGraphics fix 28 days later is a fact we record without interpreting it: Apple gives no reason. For owners of an iPhone XS, XS Max or XR it means, in practice, that their device carried a known and presumably exploited flaw for a month. If you still use such a device day to day, install iOS 18.7.11 today and be aware that these devices receive fewer fixes than newer ones.

A point we keep making: a VPN or an antivirus scanner does not help against flaws like these. A VPN encrypts the route your data takes across the network (→ What is a VPN? How the virtual private network works), but a manipulated PDF or a prepared web page arrives encrypted just the same and is processed by the device just the same. The flaw sits in the system itself – and only the update closes it there. Nor is the green camera dot a protection; it is an indicator. According to 9to5Mac, it kept lighting up during the camera flaw, which only helps if someone happens to be looking. So after the update, check under «Settings» > «Privacy & Security» > «Camera» which apps have access, and remove anything you don't recognise or no longer need.

And because flaws like the one in «Hide My Email» or in keychain access show that even privacy features can have bugs, it is worth looking at the foundations: a separate, strong password for each service (→ Create a strong password – and what is actually secure in 2026) and a second factor or passkey (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey) limit the damage if something does slip through. The updates of 26 October are no cause for worry – but a good reason to finally switch on automatic updates.