Apple fixed an image flaw used in targeted attacks. Update iPhones, iPads and Macs.

What Apple says

In Apple’s words: “Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” The fix is an out-of-bounds write closed with better bounds checking.

Apple doesn’t say who was targeted. The flaw itself is on every device that hasn’t updated, and a business owner’s phone holds email, banking and the two-step codes for everything else.

Update

1. iPhone and iPadSettings, then General, then Software Update. Install iOS or iPadOS 26.7.1 or later.
2. MacSystem Settings, then General, then Software Update. Install macOS Tahoe 26.7.1, or Sequoia 15.8.1 if the Mac is staying on Sequoia.
3. Turn on automatic updatesOn iPhone, Software Update, then Automatic Updates: turn on Security Responses and System Files so fixes like this one arrive on their own.

Which devices are covered

• iPhone 11 and later. iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later) and iPad mini (5th generation and later).
• Older iPhones. Apple’s release list shows no iOS 18 update since August 17, 2026, so an iPhone XS or XR, which can’t run iOS 26, has no listed fix. If one of those still handles company email, replace it.
• iOS 27 and macOS 27. Apple says the attacks it knows of were against versions before iOS 27. If you’ve already moved up, just keep updating.

Sources

• Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1
• Apple: About the security content of macOS Tahoe 26.7.1
• Apple: About the security content of macOS Sequoia 15.8.1
• Apple security releases
• CISA Known Exploited Vulnerabilities catalog