Apple CVE-2026-86950 CoreGraphics zero-click zero-day exploited in targeted spyware attacks: which iOS / iPadOS / macOS versions fix it, and what about iPhone exploit kits spread through Instagram ads (DarkSword, Coruna)?

What it is: CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's graphics framework. Processing a maliciously crafted file can run code with no tap or click, and Apple said it may have been exploited in an extremely sophisticated attack against specific targeted individuals. Meta's security team reported it, and Apple patched it on September 28, 2026. Separately, in late October 2026 iVerify reported criminal groups delivering the DarkSword and Coruna iPhone exploit kits through malicious ads (including a World Cup-themed Instagram ad) and compromised websites; those campaigns target iPhones that aren't up to date. Am I affected: - iPhone and iPad below iOS / iPadOS 26.7.1 (iPhone 11 and later), and Macs below macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. - Check: Settings, General, About (iPhone/iPad); Apple menu, About This Mac. For fleets, check OS versions in your MDM. Fix: 1. Update to iOS / iPadOS 26.7.1 or later, macOS Tahoe 26.7.1 or later, or macOS Sequoia 15.8.1 or later. Devices that can't run these versions should get whatever latest security update Apple offers for them, or be replaced if they no longer receive updates. 2. Turn on automatic updates (Settings, General, Software Update, Automatic Updates) and, in MDM, enforce a minimum OS version. 3. People at higher risk (journalists, activists, executives, officials) should turn on Lockdown Mode (Settings, Privacy & Security, Lockdown Mode); Apple says it has not seen a successful mercenary spyware attack against a device with it on. After: restart the device after updating (reboots also clear many non-persistent implants). If you suspect a device was targeted, preserve it for a forensic check (for example with your security team or a specialist), rotate passwords and sessions used on it, and review accounts for logins you don't recognize. Sources: https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-patches-coregraphics-zero-day-sophisticated-iphone-attacks https://www.computerworld.com/article/4228858/apple-issues-urgent-ios-patch-as-it-navigates-the-spyware-arms-race.html https://gbhackers.com/coruna-and-darksword-target-ios/