[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe8q5dK5gQbGrrD7rihHyTcSuF8fou1u2Z4JRkcqofcw":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"0fbf3890-d2fa-44f3-9af9-006f7c2ea0ca","Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’","apple-patches-meta-reported-zero-day-linked-to-extremely-sophisticated-attack-cb061c","Apple has released iOS and macOS updates to patch the zero-day vulnerability tracked as CVE-2026-86950. The post Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’ appeared first on SecurityWeek.","Apple has released urgent updates for iOS and macOS to address CVE-2026-86950, a critical out-of-bounds write vulnerability in the CoreGraphics component. This flaw allows for arbitrary code execution via specially crafted files, potentially enabling zero-click exploitation through various delivery methods like email or web pages. Apple indicated the vulnerability was reported by Meta and may have been used in 'extremely sophisticated' attacks against targeted individuals on older iOS versions.","Apple patches zero-day vulnerability CVE-2026-86950 in CoreGraphics, potentially exploited in sophisticated attacks.","Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file. Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory. No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team. Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users. Advertisement. Scroll to continue reading. It’s unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp. SecurityWeek has reached out to Meta for clarification and will update this article if the company responds. CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected. CISA has yet to add CVE-2026-86950 to its KEV catalog. This would be the ninth Apple product flaw added to the catalog this year. Related: Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe Related: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari Related: Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the PlugMicrosoft SharePoint Flaw CVE-2026-65660 Now Exploited in AttacksNorth Korea Suspected in $351 Million Bitget Crypto HeistCISA Election Security Plan Flags Patching Barriers, Voter Database AttacksWindows, Linux, Android File Notification Systems Leak User ActivityOpenAI Agents Probed Websites for Vulnerabilities While Fetching Public DataOT Security Guidance: NIST Drafts Updated Guide, CISA\u002FFBI Advise on ICS IntegratorsUS Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks Latest News Modulate Raises $25 Million to Advance Deepfake DetectionCall for Presentations Open for 2026 CISO Forum Virtual SummitPrison Sentence for Former US Soldier Who Hacked AT&T and VerizonDC Health Agency Exposes 400,000 Beneficiary RecordsGoogle Warns of ShinyHunters’ Fresh Oracle PeopleSoft CampaignNew Mexico Jury Finds Facebook Liable for Deceiving Users About Privacy ProtectionsNvidia Unveils AI Agent Safety Platform With Hardware-Based WatchdogKiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveDoppel has named Joey Rachid as Chief Security Advisor and Field Chief Information Security Officer.Delinea has appointed Timothy Regan as Chief Financial Officer.Gwen Gann has become State Chief Information Security Officer for the State of Washington at WaTech.More People On The MoveExpert Insights Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, \"data\" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fapple-patches-meta-reported-zero-day-linked-to-extremely-sophisticated-attack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002FApple-MacBook-iPhone.jpeg","2026-09-29T06:18:27+00:00","2026-09-29T08:00:23.566589+00:00",9,[18,21,23,25,28,30],{"name":19,"type":20},"iOS","product",{"name":22,"type":20},"macOS",{"name":24,"type":20},"CoreGraphics",{"name":26,"type":27},"Apple","vendor",{"name":29,"type":27},"Meta",{"name":31,"type":20},"WhatsApp","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63],{"type":57,"value":58,"context":59},"cve","CVE-2026-86950","Zero-day vulnerability in Apple's CoreGraphics component.",{"type":57,"value":61,"context":62},"CVE-2025-55177","Previously disclosed WhatsApp vulnerability.",{"type":57,"value":64,"context":65},"CVE-2025-43300","Previously disclosed Apple ImageIO zero-day."]