iPhone XR and iPhone XS security update fixes exploited flaw

Apple released iOS 18.7.11 and iPadOS 18.7.11 earlier this week, delivering a fix for a CoreGraphics flaw the company says "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27, according to Apple's security advisory. This is the iPhone XR and iPhone XS security update that matters most right now, since it's the only version that brings the fix to iPhone XS, iPhone XS Max, and iPhone XR, hardware that can't run iOS 26, along with the seventh-generation iPad (Apple Support; MacRumors).

The same release also covers iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later, per Apple's compatibility list (Apple Support). Those tablets aren't locked out of newer iPadOS versions, so this isn't strictly a legacy-hardware patch.

Who gets the iPhone XR and iPhone XS security update?

iPhone XR, iPhone XS, and iPhone XS Max owners should open Settings > General > Software Update and install iOS 18.7.11. It's live now, and it's the only update Apple lists for these three phones, since none of them support iOS 26 (Apple Support; MacRumors).

Owners of the seventh-generation iPad, iPad Air 4th generation and later, iPad 9th generation and later, or iPad mini 6th generation and later should check the same menu for iPadOS 18.7.11. Apple's advisory lists these devices as eligible for this specific release, though it doesn't explain why each one lands on this branch instead of a newer one (Apple Support).

Anyone with an iPhone or iPad that already supports iOS 26 or iOS 27 already has this fix. Apple patched the same CoreGraphics bug last month through iOS/iPadOS 26.7.1, along with macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 for Mac (BleepingComputer). On those devices, install whatever version Settings shows as available rather than hunting for iOS 18.7.11, which won't appear on newer hardware.

What the CVE-2026-86950 Apple update fixes

The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write bug in CoreGraphics, the framework Apple uses across iOS, iPadOS, macOS, watchOS, and tvOS to render vector graphics, text, and images (BleepingComputer). This Apple security update for iPhone XR and iPhone XS closes that gap on hardware that can't move to iOS 26 or iOS 27. Meta Product Security discovered the flaw, and Apple's advisory states that processing a maliciously crafted file "may lead to arbitrary code execution," fixed through improved bounds checking (Apple Support).

Apple says the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, not a broad or mass-market campaign (Apple Support). Nothing in Apple's wording suggests the typical XR or XS owner was anywhere near the target list. The company hasn't disclosed how the malicious file gets delivered, who was targeted, or how many people were affected.

This is the second Apple zero-day listed as exploited in attacks this year, according to BleepingComputer. The first, CVE-2026-20700 in dyld, also described as used in an extremely sophisticated targeted attack, was patched back in February (BleepingComputer).

Two more fixes bundled into this release

iOS 18.7.11 isn't a single-issue patch. The same release notes describe a separate logic issue that could let an app leak sensitive user information, addressed with improved checks (Apple Support).

It also closes an access-control gap that could let a malicious app reach the camera without user permission (Apple Support).

The prior update for these same four devices, iOS 18.7.10, shipped about two months ago and addressed roughly 120 CVE entries across more than 30 components, according to Apple's release notes. That volume says something about how much security work still touches this branch, though it's not a guarantee the pace stays the same going forward.

Does this mean iOS 18 is fully protected going forward?

Not necessarily. Apple's own deployment documentation notes that "not all known security issues are addressed in previous versions" because some fixes depend on architectural changes that exist only in the current OS, which is iOS 27 (Apple Support). This backport shows Apple is still issuing meaningful iOS 18 security patches, but it doesn't guarantee every future fix lands on the same timeline, or at all.

Background Security Improvements, Apple's faster mechanism for shipping fixes without a full update, go out only to the latest versions of iOS, iPadOS, and macOS (Apple Support). Apple's documentation says that any Background Security Improvements built for iOS 18 get folded into the regular software update instead of arriving separately, but it stops short of promising that older branches receive every fix developed for newer OS versions (Apple Support).

This week's separate iOS 26.7.2 and iPadOS 26.7.2 updates patched 134 vulnerabilities, with none flagged as exploited in the wild (MacRumors). Apple runs several OS branches at once, and there's no indication coverage is identical across all of them. Apple's current advisory doesn't give an end date for iOS 18 security support, so this release is worth treating as current protection, not a promise of long-term parity with iOS 27.

What to do now

Install iOS 18.7.11 today if you're on an iPhone XR, XS, or XS Max, or iPadOS 18.7.11 if your iPad is on the eligible list, through Settings > General > Software Update. The attack Apple describes was narrow and highly targeted, but the same release also closes a flaw that may allow arbitrary code execution, a data-leak bug, and a camera-permission bypass, so there's little reason to wait. Anyone on hardware that supports iOS 26 or iOS 27 should install whichever newer version Settings offers instead, and everyone should keep an eye on Apple's security-content pages rather than assume this backport sets a permanent precedent for the next exploited flaw.