Apple Patches Actively Exploited Graphics Bug in iOS 26, iPadOS 26, and macOS 26
Apple says CVE-2026-86950, discovered by Meta’s security team, may have enabled “extremely sophisticated” attacks against targeted users. The September 29 patch is urgent: nearly four in five iPhone owners still run iOS 26.
Apple has released security updates to fix a vulnerability in iOS 26, iPadOS 26, and macOS 26 that the company says “may have been exploited” in attacks against specific users. The patch was made available on September 29, 2026.
The bug, tracked as CVE-2026-86950, was found in the graphics engine that powers the user interface and visuals across iPhones, iPads, and Macs. Apple said the flaw could be used to launch “an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Because a device’s graphics engine typically has broad access to the rest of the operating system, a successful exploit could potentially allow a hacker to steal a wide range of personal data from an affected device.
Meta’s product security team was credited with discovering the vulnerability. Neither Apple nor Meta provided comment on how the bug was found, how many devices may have been compromised, or who may be behind the attacks — leaving open whether government spyware makers or cybercriminals are responsible.
The update is particularly urgent given that nearly four in five iPhone owners are still running iOS 26, according to Apple’s own statistics. Users already on iOS 27, iPadOS 27, and macOS 27 — released earlier in September 2026 — also received a software update but are not affected by the exploited bug.
The patch comes shortly after Apple fixed a separate critical flaw, CVE-2026-86869, described by Belgian cybersecurity firm ironPeak as a “zero-click” vulnerability. That bug could be silently triggered through a maliciously crafted iMessage, requiring no interaction from the target, and was capable of bypassing BlastDoor, Apple’s sandbox security feature for iMessage. Apple fixed that vulnerability with the release of iOS 27 in September 2026, crediting ironPeak researcher Niels Hofmans and Meta security researchers with the discovery. It is not yet known whether that bug was used in any attacks before it was patched.