Apple has issued an urgent security warning for users of three iPhone models, saying a flaw in them has created a risk of cyber attack. Through it, attackers could place harmful code on a user’s iPhone without their knowledge and collect information.
Which phones, and what the flaw is
The affected models are the iPhone XS, iPhone XS Max and iPhone XR.
The flaw, CVE-2026-86950, was found in an older version of Apple’s CoreGraphics software, which is used to process images and other visual material. Opening a specially crafted malicious file on the iPhone can therefore give attackers the chance to run unauthorised code on the device.
According to Apple, it is believed the flaw has already been used in cyber attacks aimed at specific individuals. The flaw can be exploited through a file carrying code that appears, on the face of it, entirely ordinary.
What to do
A new version, iOS 18.7.11, has been released to fix it. It also corrects a second flaw, through which a malicious app could switch the camera on or off without permission.
Anyone using an iPhone XS, XS Max or XR should download the update promptly. Settings → General → Software Update.
Two things worth understanding about this
First, the good news that is easy to miss. These are 2018 phones. Apple is still shipping security patches for hardware that is eight years old, which is unusual in the industry and is a genuine argument for the platform — many Android devices of the same vintage stopped receiving any security updates years ago.
Second, the phrase “aimed at specific individuals” carries most of the meaning in this story, and it is the detail that tells you what kind of flaw this is.
A bug that is already being used against named targets rather than sprayed at everybody is the signature of commercial surveillance tooling. That does not mean most owners of these phones were at risk — it means the opposite, which is precisely why the people who were at risk are worth thinking about. Journalists, lawyers, opposition politicians and human rights workers are the standing customer list for this category of attack, and an older phone is not a disqualification from being a target.
It is also why the fix matters more than the odds. The question is not whether you personally were likely to be targeted, but whether the door stays open for the next person who is.
Why an image library keeps being the way in
CoreGraphics parses images. So does every messaging app, browser and mail client that shows you a picture — which means the code runs constantly, on untrusted input, before a user has decided to trust anything. That is why image and font parsers are among the most heavily targeted components in any operating system, and why a flaw in one is worth more to an attacker than a flaw almost anywhere else.
It also explains the shape of the advice. You cannot avoid this by not opening suspicious files, because the file is processed in order to show it to you.
For readers here
The iPhone XS, XS Max and XR are still common in Dhaka’s second-hand market, where an eight-year-old iPhone is a reasonable buy precisely because it still gets updates. That remains true — but it depends entirely on the update actually being installed.
If you are using one of these as a daily phone, or have handed one down to a family member who does not check for updates, this is the week to look. And if you are buying a used iPhone, the question to ask the seller is not how old it is but which iOS version it is on.
Prothom Alo credits the Daily Mail for the report.
