Apple has fixed security vulnerabilities in iOS 26, iPadOS 26, and macOS 26, operating systems that the company said could be “exploited” by hackers. The tech giant said the now-fixed bug could be used to launch “extremely sophisticated attacks against specific targeted individuals on iOS versions prior to iOS 27.”
According to the item on Apple’s security pageThe bug was found in the main graphics engine that powers the user interface and visualization on iPhones, iPads and Macs.
The Meta product security team was credited with the discovery.
Details of the bug, officially classified as CVE-2026-86950, have not been released, but the device’s graphics engine typically has broad access to the rest of the device’s operating system. A successful exploit could allow hackers to steal extensive personal information from affected devices.
When reached by TechCrunch, Apple and Meta spokespeople did not comment on how the flaw was discovered, or how many people had their devices hacked because of this flaw, if any. It is also unclear who might be using the bug, such as government spyware producers or cyber criminals.
While the bug affects previous versions of Apple’s operating system, it remains in widespread use. Almost four out of five iPhone owners are still using iOS 26, according to the company Statistics. Devices using the latest versions, iOS 27, iPadOS 27, and macOS 27, released earlier this month, also received software updates on Tuesday but were not affected by the bug.
Now fix the “zero click” error separately
News of the security patch comes shortly after Apple fixed another major security flaw, known as CVE-2026-86869, which could allow hackers to silently steal data from affected iPhones, iPads or Macs.
Belgian Internet security research company ironPeak published Writing details last week explained That bug is a “zero-click” vulnerability that can be triggered invisibly through a maliciously crafted iMessage, without the user’s knowledge. The bug does not require any interaction from the victim, such as clicking on a link, and is highly sought after by surveillance vendors and spyware manufacturers.
Per ironPeak’s answer, the bug can bypass BlastDoor, a security feature implemented by Apple to prevent malicious code, such as spyware, from escaping iMessage’s sandbox and hacking users’ devices.
Apple fixed the bug in September with the release of iOS 27, iPadOS 27, and macOS 27, and Rating Niels Hofmans of ironPeak With the findings, along with security researchers at Meta who confirmed their findings in a Posted in X.
It is not yet known whether this bug was used in cyber attacks before it was fixed.
When you purchase through a link in our article, we may receive a small fee. This does not affect the independence of our editors.
