If you still use an iPhone XS, iPhone XS Max or iPhone XR, stop what you are doing and check for a software update. Apple released iOS 18.7.11 on October 26, 2026, and it closes a security hole that Apple says may already have been used in real attacks — a flaw newer iPhones had fixed for almost a month.
These are the oldest iPhones still getting security updates, and they cannot run iOS 26. That is exactly why this release matters: for these phones, iOS 18.7.11 is the only way to close the hole.
Key Takeaways
- iOS 18.7.11 (and iPadOS 18.7.11) arrived October 26, 2026 for iPhone XS, XS Max, XR and older iPads still on iOS 18.
- It fixes CVE-2026-86950, an out-of-bounds write in CoreGraphics that can let a maliciously crafted file run arbitrary code. CISA rates it CVSS 8.8 (High).
- Apple says the flaw “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
- The same flaw was fixed for newer iPhones on September 28, 2026 in iOS 26.7.1 — older devices waited about four weeks.
- The update also closes a camera-access flaw (CVE-2026-86990) that could let a malicious app use the camera without permission.
What Is CVE-2026-86950?
CVE-2026-86950 is a memory bug — an out-of-bounds write — in CoreGraphics, the Apple framework that renders images, text and documents across iOS, iPadOS, macOS, watchOS and tvOS. Apple’s own wording is blunt: “processing a maliciously crafted file may lead to arbitrary code execution.”
In practice, that means opening or even previewing a booby-trapped file could hand an attacker control of the device. CoreGraphics is reached by first-party apps that automatically render previews in received media — Mail, Messages, Safari and QuickLook — so the attack surface is wider than a single app.
Apple credits Meta Product Security with reporting the flaw. The US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on September 29, 2026, with a remediation deadline of October 13 for federal agencies. Apple has not named any victims or attackers, and says the exploitation it is aware of targeted specific individuals rather than a mass campaign. Even so, this is the second exploited Apple zero-day fixed this year, according to BleepingComputer.
Which Devices Get iOS 18.7.11?
| Device | Update |
|---|---|
| iPhone XS | iOS 18.7.11 |
| iPhone XS Max | iOS 18.7.11 |
| iPhone XR | iOS 18.7.11 |
| iPad (7th generation) | iPadOS 18.7.11 |
| iPad Air (4th gen and later), iPad (9th gen and later), iPad mini (6th gen and later) still on iOS 18 | iPadOS 18.7.11 |
These phones cannot install iOS 26, so they stay on the iOS 18 line — and the iOS 18 line only received this fix on October 26. The previous update for these devices, iOS 18.7.10, shipped on August 17, 2026.
If your iPhone supports iOS 26 or iOS 27, install whichever newer version Settings offers instead — the fix is already included there. On the same day Apple shipped iOS 18.7.11, it also released iOS 26.7.2 for devices on the iOS 26 branch, patching 134 vulnerabilities.
Also Fixed: A Camera-Access Flaw
iOS 18.7.11 is not a one-bug update. It also closes CVE-2026-86990, an access issue that could let a malicious app reach the camera without user permission, reported by researcher Mustafa Calap. Apple lists a second app-level flaw fixed in the same release. Neither is flagged as exploited, but both are the kind of permission bypass that should not sit unpatched on a phone you carry everywhere.
Why Older iPhones Waited a Month
The timeline is the uncomfortable part of this story:
- September 28, 2026: Apple fixes CVE-2026-86950 in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
- September 29, 2026: CISA adds the flaw to its KEV catalog as actively exploited.
- October 26, 2026: Apple backports the fix to iOS 18.7.11 for the devices that cannot move to iOS 26.
That is roughly four weeks in which the oldest supported iPhones were exposed to a flaw already listed as exploited. Apple has not given an end date for iOS 18 security support, so this release should be treated as current protection — not a promise of long-term parity with iOS 27.
How to Install iOS 18.7.11
- Connect to Wi-Fi and back up your iPhone.
- Open Settings → General → Software Update.
- Tap Download and Install for iOS 18.7.11.
- Install immediately — not tonight, not this weekend.
The update is small and the install takes only a few minutes. If the update does not appear, the rollout may still be reaching your device — check again later the same day.
FAQ
Which iPhones get iOS 18.7.11?
iPhone XS, iPhone XS Max and iPhone XR, plus iPad (7th generation) and other iPads still on the iOS 18 line. These devices cannot run iOS 26, so iOS 18.7.11 is their fix.
What does iOS 18.7.11 fix?
It fixes CVE-2026-86950, an exploited CoreGraphics flaw that could let a malicious file run code on the device, plus a camera-access flaw (CVE-2026-86990) and another app-level bug.
Was CVE-2026-86950 actually exploited?
Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals.” CISA lists it in its Known Exploited Vulnerabilities catalog. No mass campaign has been reported.
Why did older iPhones get the fix a month later?
Apple patched the flaw in iOS 26.7.1 on September 28, 2026, and only backported it to the iOS 18 line on October 26, 2026 — about four weeks later.
Should I update if my iPhone runs iOS 26 or iOS 27?
Yes — install whichever newer version Settings offers. The CoreGraphics fix is already included in iOS 26.7.1 and later, and in iOS 27.2.
