The iPhone XR has just been given a fix Apple shipped a month ago

CVE-2026-86950 was fixed on current iPhones in late September, in iOS 26.7.1. Apple's wording about it has not softened since: the company "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." CISA added it to the known exploited vulnerabilities catalogue on 29 September. On 26 October the fix finally reached the handsets Apple no longer gives new iOS versions to.

That is iOS 18.7.11 and iPadOS 18.7.11, covering the iPhone XS, XS Max and XR, the seventh-generation iPad and several older iPads. The bug is an out-of-bounds write in CoreGraphics, the part of the system that draws things, reported by Meta Product Security, and opening a booby-trapped file is enough to run code. "Extremely sophisticated attack against specific targeted individuals" is Apple's house phrasing for commercial spyware, so the realistic risk to anyone reading this was never high.

The other two fixes in that update are closer to everyday life. One sits in CoreMedia, where "a malicious app may be able to access the camera without user permission", and the other in Audio. Neither is known to have been used against anybody. Both are the kind of thing that turns up in a bulk malware kit a year later.

The same day brought iOS and iPadOS 27.2 with 163 fixes and macOS Golden Gate 27.2 with 263, which SecurityWeek counted as 286 distinct bugs between them. The habit worth borrowing is checking the old device in the drawer, the one kept for music or handed to a child, because nothing prompts you about a phone you rarely open. The equivalent gap on a Windows PC is in the installed apps rather than the OS, which is what Tendvane's winget-based updater handles: it lists what has fallen behind and brings it forward in one pass.