Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’

Apple has issued updates for iOS, iPadOS, and macOS to address a zero-day flaw that attackers may already be abusing in targeted operations. The bug, CVE-2026-86950, lives in the CoreGraphics component and is an out-of-bounds write that can trigger code execution when a device processes a maliciously crafted file, potentially through web content, email, or messaging apps, raising the possibility of zero-click attacks. Apple credits Meta's security team with reporting the issue and says it has indications the flaw was used in a highly sophisticated campaign against a small number of specific individuals running iOS versions prior to iOS 27. The fix is included in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, while newer iOS 27 and macOS Golden Gate 27 builds appear unaffected; CISA has not yet listed the CVE in its Known Exploited Vulnerabilities catalog.