Apple announced the bug could have allowed attackers to run their code of choice on a compromised device.
Apple just patched a security vulnerability that could have serious cybersecurity implications for iPhone and iPad users who are running outdated software.
The iPhone-maker released iOS 26.7.1 and iPadOS 26.7.1 on Monday to patch a single vulnerability that cybercriminals may have exploited in targeted attacks.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company wrote in a security bulletin.
Although Apple is habitually scant on details about security vulnerabilities, the company did disclose that the bug affected CoreGraphics, a tool developers can use for two-dimensional drawing and rendering. Apple stated that processing a malicious file could lead to “arbitrary code execution,” an exploit that means an attacker can effectively run their code of choice on an affected device.
Weekly roundup of the latest in tech news
An Inc.com Featured Presentation
Apple did not hint at who may have been targeted by the attack or how widespread the exploit may have been, but did credit Meta Product Security with finding the bug. The patch is for devices that are still running iOS 26, despite that the newer generation of software, iOS 27, has been available since mid-September. One expert told Forbes that Apple issued a patch for people who are intentionally operating iOS 26, which could mean enterprise customers.
“Major OS upgrades are often phased while organizations validate applications, workflows and compatibility,” he said.
In spite of iOS 27’s release, Apple’s own statistics show that 86 percent of iPhones introduced in the past four years are still running iOS 26. The same is true of roughly 79 percent of iPads.
Apple has ramped up the deployment of its cybersecurity updates in recent months in response to how AI has accelerated the development of malicious hacking tools and the time hackers need to exploit security flaws. Although some groups may be choosing to run older software, cybersecurity experts broadly recommend updating devices and software with the latest software patches and releases for the best security. TechCrunch reported that this latest patch comes shortly after Apple patched another critical bug that may have allowed malicious actors to steal information from compromised iPhones, iPads and Mac computers.
iOS 26.7.1 is available for the iPhone 11 and later, and iPadOS 26.7.1 is available for several makes and models of iPad. Visit “settings,” “general,” and “software update” to update your device.
Get 1 Smart Business Storydelivered straight to your inbox when you subscribe to Inc.’s free daily newsletter.
