If you still use an iPhone XS, XS Max or XR, iOS 18.7.11 is the update to install today. It patches a CoreGraphics bug that Apple says may have been used in an “extremely sophisticated” attack on specific people. Here’s what it fixes, who needs it, and how to get it.
Apple shipped the update on October 26, according to Bitdefender. Newer devices already got the same fix weeks ago.
- Update: iOS 18.7.11 and iPadOS 18.7.11
- Devices: iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation)
- Main bug: CVE-2026-86950, a CoreGraphics out-of-bounds write (CVSS 8.8)
- Risk: opening a crafted file could run attacker code
- Cost: free, via Settings > General > Software Update
That’s the short version. If you want the detail, keep reading.
What the iOS 18.7.11 update actually fixes
The headline flaw is CVE-2026-86950. It’s an out-of-bounds write in CoreGraphics, the part of Apple’s software that draws and processes graphics. Apple says “processing a maliciously crafted file may lead to arbitrary code execution.”
In plain terms, a booby-trapped image or document could let an attacker run their own code on your phone. Meta’s product security team reported the bug.
The update also closes two other holes, both reported by Bitdefender as not known to be exploited. One audio bug could let an app read sensitive data. A CoreMedia bug could let a malicious app reach the camera without permission.
Is it really being attacked in the wild?
Apple says it received a report that the bug “may have been exploited” against specific targeted individuals. That wording is cautious, and Apple hasn’t said who was hit, how many, or how the files were delivered.
Most people aren’t the target of this kind of attack. Still, a patch that exists is a patch you should install, because details tend to spread once a fix goes public.
One oddity: Security Affairs says Apple described the attacks as affecting iOS versions before iOS 27. Why the older-phone fix landed weeks after the newer one isn’t explained.
Which devices get which fix
The same bug was patched in stages. BleepingComputer covered the first round on September 29, and the older-device build followed in late October.
| Your device | Fixed in | When |
|---|---|---|
| iPhone XS, XS Max, XR; iPad (7th gen) | iOS / iPadOS 18.7.11 | October 26 |
| iPhone 11 and later | iOS 26.7.1, or iOS 27.2 and later | Late September onward |
| Macs | macOS Tahoe 26.7.1, Sequoia 15.8.1, or Golden Gate 27.2 | Late September onward |
If you’re on a current iPhone, you’re likely covered already. Our guide to what’s new in iOS 27.2 explains that update, and the macOS Golden Gate 27.2 rundown covers the Mac side.
How to install the iOS 18.7.11 update
Plug in your phone or make sure it has at least 50% battery, and connect to Wi-Fi. Then follow these steps.
- Open Settings and tap General.
- Tap Software Update and wait for the check to finish.
- Choose the iOS 18.7.11 option and tap Install Now.
Afterward, turn on Automatic Updates on that same screen so the next security fix lands without you doing anything. Back up first if you haven’t in a while.
Until you update, be wary of files from people you don’t know. That means odd attachments and links in email or messages.
Keeping an older iPhone safe after this update
The XS and XR are several years old, and Apple eventually stops sending them fixes. Getting iOS 18.7.11 now is good, but it isn’t a long-term plan.
Keep the basics tight. Update soon after each release, don’t open unexpected files, and avoid tapping links from unknown senders. Our write-up on how exploit chains get patched shows why staying current matters so much.
Apple’s own guidance is simple too: install the latest compatible version. For these four devices, that’s iOS 18.7.11 or iPadOS 18.7.11.
Frequently Asked Questions
Do I need iOS 18.7.11 if I have an iPhone 11 or newer?
No. Newer iPhones got the CoreGraphics fix in iOS 26.7.1 and later releases, including iOS 27.2. Just make sure you’re on the latest version.
Is my iPhone XS or XR safe if I don’t update?
It’s riskier. Apple says the bug may have been used in targeted attacks, and an unpatched phone keeps the hole open.
Will the update slow my old iPhone down?
This is a security release, so big changes are unlikely. Apple hasn’t flagged any performance changes.
Can I tell if I was attacked?
Not easily. Apple hasn’t shared signs to look for, so the best move is to update and keep automatic updates on.
If your phone is on the list, stop reading and update. It takes ten minutes, costs nothing, and closes a hole Apple itself says was used in real attacks. And if the phone can’t update any further someday, treat that as a good reason to replace it.
Leave a Reply