Insights Security & Privacy
Update your iPhone, iPad or Mac: Apple fixed a flaw that may have been exploited
The short version
Apple fixed a flaw in iPhones, iPads and Macs that may have been used in a very targeted attack. If your device still runs version 26 of Apple's software, install the new update soon, because the vulnerability is now public.
What happened
The flaw sat in CoreGraphics, the part of Apple's software that draws images and other visuals. A specially made file could let an attacker run their own instructions on the device. Apple says it may have been used in an extremely sophisticated attack on specific people using versions of iOS before iOS 27.
The fixes are iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Devices on version 27, released earlier this month, are not affected. Apple and Meta did not tell TechCrunch how many devices were hit, if any, and it is unclear who is behind the attacks. Meta's security team was credited with finding the flaw.
Why it matters to you
TechCrunch reports that almost four in five iPhone owners still run iOS 26, so many devices may still need the update. Others could now try to exploit the flaw against devices that have not been updated. TechCrunch notes that a successful attack on this part of the system could potentially let a hacker steal personal data.
What to do
On an iPhone or iPad, open Settings, then General, then Software Update, and install what is offered. Turn on Automatic Updates on the same screen. On a Mac, open the Apple menu, then System Settings, General, Software Update. Keep the Mac plugged in while it installs.
Sources
- iOS 26.7.1 Fixes Vulnerability Used in Targeted Attacks MacRumors (opens in a new tab)
- Still running iOS 26? Update your iPhones, iPads, and Macs for this urgent security fix TechCrunch (opens in a new tab)
- Update your iPhone, iPad, or Mac: Flaw could run attackers' code Malwarebytes (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.