Apple fixes iOS security bug it says may have been exploited

Apple has fixed a security vulnerability affecting iOS 26, iPadOS 26 and macOS 26 that the company says “may have been exploited” by hackers. In a listing on its security pages, Apple said the now-patched bug, tracked as CVE-2026-86950, could be used to launch “an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”

The flaw lives in the main graphics engine that powers the user interface and visuals across iPhones, iPads and Macs. Apple has not released details of the bug, but a device’s graphics engine typically has broad access to the rest of the operating system, meaning a successful exploit could potentially let a hacker steal a wide range of personal data from an affected device. Meta’s product security team was credited with the discovery. When contacted, spokespeople for Apple and Meta did not say how the bug was found or how many devices, if any, had been compromised, and it remains unclear who might be exploiting it — whether government spyware makers or cybercriminals.

The vulnerability affects Apple’s previous generation of operating systems, but those remain in wide use: almost four-in-five iPhone owners are still running iOS 26, according to Apple’s own statistics. Devices already running the newer iOS 27, iPadOS 27 and macOS 27, released earlier this month, also received a software update on Tuesday, though Apple says they are not affected by the bug under active attack.

The disclosure comes soon after Apple fixed a separate, more severe “zero-click” bug, tracked as CVE-2026-86869, that could have let hackers silently steal data from affected iPhones, iPads or Macs. Belgian cybersecurity firm ironPeak published a detailed writeup last week explaining that the bug could be invisibly triggered by a maliciously crafted iMessage, without the user’s knowledge. Such bugs require no interaction from the victim, such as clicking a link, and are highly sought after by surveillance vendors and spyware makers. The bug was also capable of bypassing BlastDoor, the security feature Apple built to keep malicious code — including spyware — from escaping iMessage’s sandbox. Apple fixed that bug in September with the release of iOS 27, iPadOS 27 and macOS 27, crediting ironPeak researcher Niels Hofmans alongside security researchers at Meta, who confirmed the findings in a post on X. It is not yet known whether the zero-click bug was used in cyberattacks before it was fixed.

Why it matters

The back-to-back disclosures underscore how much of Apple’s installed base still runs vulnerable software months after a fix ships, and how iMessage’s sandbox remains a prime target for the surveillance vendors and spyware makers who prize bugs requiring no user interaction.