Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

Apple has pushed out iOS and macOS updates to fix an out-of-bounds write bug in its CoreGraphics framework, tracked as CVE-2026-86950, which a threat actor has already used in real-world attacks. The flaw carries a CVSS score of 8.8 and lets an attacker run arbitrary code, affecting a wide swath of devices from the iPhone 11 onward as well as multiple iPad generations, with Apple also issuing fixes for macOS Tahoe and Sequoia. Apple describes the activity as an "extremely sophisticated" campaign aimed at a narrow set of specific individuals, language researchers say suggests a nation-state or commercial spyware operator rather than ordinary cybercriminals. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 26-04, is requiring federal agencies to apply Apple's mitigation within three days and complete a compromise check by October 2, while experts urge all organizations to treat the patch as an emergency update rather than wait for routine cycles.