Apple has pushed a fix for a flaw used in real attacks to older iPhones and iPads that missed last month's patch. Updating takes a few minutes.
Apple has released a security fix for older iPhones and iPads that were left out when the same problem was patched in September. Apple says attackers have already used the flaw against specific, targeted people. If you have one of the older models listed below, update now.
The flaw sits in CoreGraphics, a part of Apple's software that draws images and text on the screen. Meta's security team found it. It is an "out-of-bounds write" bug, which means a program can be tricked into writing data to a place in memory where it does not belong.
That kind of bug can crash an app, damage data, or let an attacker run their own code on the device. Apple's notice says that opening a maliciously crafted file may lead to that outcome. Apple fixed it by adding better checks on how much data gets written.
The September fix reached devices running iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. This week's update extends the fix to the iPhone XS, XS Max and XR. It also covers the iPad 7th generation, the iPad 9th generation and later, the iPad Air 4th generation and later, and the iPad mini 6th generation and later.
Apple described the attacks as "extremely sophisticated" and aimed at specific individuals, on versions of iOS before iOS 27. Most people are unlikely to be a target. Still, the bug is now public, and the report strongly advises installing the patch to block possible attacks.
The steps are in the alert box above. In short, check for the update on every older iPhone or iPad in your home or business, including the one a child or parent uses. Turning on automatic updates means the next fix arrives without you having to remember.
This is the second zero-day Apple has fixed this year that was used in attacks. A zero-day is a flaw attackers exploit before a fix exists. The first, in a system component called dyld, was patched in February and was also used in targeted attacks.
The material does not say who was targeted, how many devices were hit, or how the booby-trapped file reached them. Those details may come out later. Until then, the safest habit is the simple one: keep devices updated and be wary of unexpected files or images from strangers.
If you use an iPhone XS, XS Max, XR or an older supported iPad, install the latest update now to close a flaw attackers have used.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
