Apple released a large set of security updates on Monday 26 October 2026, fixing 286 vulnerabilities across its newest iOS and macOS releases. The iOS and iPadOS 27.2 updates address 163 flaws, while macOS Golden Gate 27.2 addresses 263, with roughly 140 flaws shared between the two systems, SecurityWeek reported.

The fixes cover memory corruption problems in WebKit, the kernel and media-handling components, some of which could allow arbitrary code execution. Other repairs address apps gaining access to sensitive data, privacy bypasses, sandbox escapes, privilege escalation and Gatekeeper bypasses. On macOS, the update also fixes remote-management and file-sharing flaws that could be reached over a network.

Older devices get the exploited-flaw fix

Separately, iOS and iPadOS 18.7.11 bring a fix for CVE-2026-86950 to older hardware: the iPhone XS, XS Max and XR, and the seventh-generation iPad. The flaw is an out-of-bounds write in CoreGraphics, reported by Meta's product security team. Apple said it may have been exploited in an extremely sophisticated attack against specific people on versions before iOS 27.

The same flaw had already been fixed in September in iOS 26.7.1 and related releases, and it was added to the US CISA Known Exploited Vulnerabilities catalogue on 29 September 2026. Apple has not publicly identified the people targeted or how malicious files reached them, and no other flaw in the October releases is described as known to have been exploited. Users on supported devices should install the update offered for their device.

Sources: SecurityWeek and Asia Daily.