Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix

Apple has fixed a information vulnerability successful its iOS 26, iPadOS 26 and macOS 26 operating systems that the institution says “may person been exploited” by hackers. The tech elephantine said the now-fixed bug could beryllium utilized to motorboat “an highly blase onslaught against circumstantial targeted individuals connected versions of iOS earlier iOS 27.”

According to a listing connected Apple’s information pages, the bug was recovered successful the main graphics motor that powers the idiosyncratic interface and visuals connected iPhones, iPads and Macs. 

Meta’s merchandise information squad was credited with the discovery.

Details of the bug, officially classed arsenic CVE-2026-86950, were not released, but a device’s graphics motor typically has wide entree to the remainder of the device’s operating system. A palmy exploit could perchance let a hacker to bargain a wide scope of idiosyncratic information from an affected device.

When reached by TechCrunch, spokespeople for Apple and Meta did not supply remark astir however the bug was discovered, oregon however galore radical had their devices hacked owed to this vulnerability, if any. It’s besides unclear who whitethorn beryllium exploiting the bug, specified arsenic authorities spyware makers oregon cybercriminals.

While the bug affects Apple’s erstwhile procreation of operating systems, it remains successful wide usage. Almost four-in-five of Apple’s iPhone owners are inactive moving iOS 26, according to the company’s own statistics. Devices moving the latest version, iOS 27, iPadOS 27, and macOS 27, released earlier this month, besides received a bundle update connected Tuesday, but are unaffected by the bug nether attack.

A abstracted ‘zero-click’ bug present fixed

News of the information spot comes soon aft Apple fixed different captious information bug, known arsenic CVE-2026-86869, which could person allowed hackers to silently bargain information from affected iPhones, iPads, oregon Macs. 

Belgian cybersecurity probe steadfast ironPeak published a elaborate writeup past week explaining that the bug was a “zero-click” vulnerability that could beryllium invisibly triggered via a maliciously crafted iMessage, without the user’s knowledge. Such bugs necessitate nary enactment from the victim, specified arsenic clicking a link, and are highly sought-after by surveillance vendors and spyware makers. 

Per ironPeak’s post, the bug is susceptible of bypassing BlastDoor, a information diagnostic that Apple implemented to forestall malicious code, similar spyware, from escaping iMessage’s sandbox and hacking the user’s device.

Apple fixed the bug successful September with the merchandise of iOS 27, iPadOS 27, and macOS 27, and credited ironPeak’s Niels Hofmans with the discovery, alongside information researchers astatine Meta who confirmed their findings successful a post connected X.

It’s not yet known if this bug had been utilized successful cyberattacks earlier it was fixed.