Apple's iOS 27.2 fixes more than 160 security flaws, and older iPhones get a patch for a bug Apple says may have been exploited

As of 5:56 p.m. ET, Tuesday, Oct. 27, 2026

Apple released iOS 27.2 and iPadOS 27.2 on Monday, Oct. 26, with fixes for more than 160 security vulnerabilities, according to the company's security notes. The same day, it released iOS 18.7.11 for older iPhones and iPads, which patches a flaw in its CoreGraphics framework that Apple says may have been exploited in targeted attacks.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," Apple wrote in its notes for iOS 18.7.11. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in which "processing a maliciously crafted file may lead to arbitrary code execution," Apple said. It credited Meta Product Security with reporting it.

Apple's security releases page lists iOS 18.7.11 for the iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation, devices that cannot run newer versions of iOS. BleepingComputer reported that Apple had patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

What's in iOS 27.2

iOS 27.2 is available for the iPhone 11 and later. Its security notes list fixes across dozens of system components, including CoreGraphics, where Apple said "processing a maliciously crafted PDF file may lead to memory corruption," and the App Store, where it said a remote attacker "may be able to break out of the WebContent sandbox." Apple's notes for iOS 27.2 do not say any of those flaws was exploited.

Apple also released iOS 26.7.2 on Monday for devices still on iOS 26, along with updates for macOS, watchOS, tvOS, visionOS and Safari, according to its security releases page. TechCrunch reported that many of the iOS 27.2 fixes were also brought to iOS 26, and that Apple says about 80% of iPhone owners are still running iOS 26.

Beyond security, iOS 27.2 adds Siri AI support in French, Japanese, Korean, Portuguese and Spanish in beta, TechCrunch reported.

Users can install the updates in Settings, under General and then Software Update.

What is not known

Apple did not say who exploited the CoreGraphics flaw, how many people were targeted, or how the attacks were carried out. Apple's policy is not to disclose or confirm security issues until an investigation has occurred and patches are available, according to its security notes.