Apple has released iOS 18.7.11 for the iPhone XS, iPhone XS Max and iPhone XR. The update, dated October 26, also reaches the iPad 7th generation as iPadOS 18.7.11. Its most important fix is for CVE-2026-86950, the CoreGraphics flaw Apple says may have been exploited in targeted attacks. Newer iPhones got the same fix four weeks earlier, in iOS 26.7.1 on September 28.
This isn’t a new zero-day. It’s the same bug, now patched on the oldest iPhones Apple still supports. These models can’t run iOS 26 or iOS 27, so iOS 18 is the only branch that could carry the fix.
What iOS 18.7.11 fixes on the iPhone XS and XR
The CoreGraphics bug is an out-of-bounds write. Apple says a maliciously crafted file could use it to run arbitrary code on the phone. The fix adds improved bounds checking, and Meta Product Security is credited with the report. Apple’s iOS 18.7.11 notes carry the same warning it attached to the iOS 26.7.1 fix:
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
The update also closes two privacy holes. A CoreMedia flaw (CVE-2026-86990) could let a malicious app access the camera without the user’s permission. An Audio flaw (CVE-2026-65339) could let an app leak sensitive user information. That makes three CVEs in total for this release.
Owners of these phones waited 28 days longer than iOS 26 users for a fix to a bug Apple says may have been exploited. That gap matters most for anyone who could be a target. Still, Apple deserves credit for continuing to patch 2018 iPhones at all.
Which devices get iOS 18.7.11
Apple’s security releases index lists four devices for this update:
- iPhone XS
- iPhone XS Max
- iPhone XR
- iPad 7th generation (as iPadOS 18.7.11)
A security patch doesn’t extend app support, though. Microsoft is dropping iOS 18 support in OneDrive, which hits these exact models. WhatsApp is also blocking logins on phones running outdated software. Patched or not, these phones are running out of road.
Newer iPhones: iOS 27.2 and iOS 26.7.2
Apple shipped two larger updates on the same day for the iPhone 11 and later. iOS 27.2 is the main release. iOS 26.7.2 is for devices that are staying on iOS 26.
By our count of Apple’s notes, iOS 27.2 addresses 163 unique CVE IDs. iOS 26.7.2 addresses 134. CVE-2026-86950 appears on neither list because both branches already had the fix. A few of the iOS 27.2 entries stand out for privacy:
- Apple Intelligence (iPhone 15 Pro and later): a remote attacker may have been able to access sensitive user data. CVE-2026-86987.
- Mail: the Hide My Email feature could leak the user’s original email address. CVE-2026-112500.
Six CVE entries on the iOS 27.2 page credit Calif, the team behind the launch-day iPhone Duo jailbreak. Apple’s iOS 27.2 notes don’t flag any of these fixes as exploited.
How to install the update
Open Settings, then go to General > Software Update. The phone will offer iOS 18.7.11, iOS 26.7.2 or iOS 27.2, depending on the model and the branch it’s on. Owners of an iPhone XS, XS Max or XR should install iOS 18.7.11 now, given the exploitation warning.
Source: Apple (iOS 18.7.11), Apple (iOS 26.7.1), Apple (iOS 27.2), Apple (iOS 26.7.2), Apple security releases
