Apple has issued an urgent warning to some iPhone users about a security flaw that may have been exploited in an 'extremely sophisticated attack.'
The vulnerability could let attackers run malicious instructions on a device by getting it to process a booby-trapped file, an ordinary-looking file deliberately altered to exploit a security weakness when your phone processes it.
For ordinary users, that means a seemingly harmless document could become a route into vulnerable software.
The iOS 18.7.11 update, released October 26, is available for the iPhone XS, iPhone XS Max and iPhone XR.
It also fixes a separate flaw that could allow a malicious app to access the camera without asking permission.
A third fix closes a weakness that could let an app expose sensitive personal information.
Owners of the affected phones should act now by opening Settings, selecting General and tapping Software Update to check for the download.
The reported attacks targeted specific individuals, and Apple has not identified the victims or said the camera flaw was used against them.
The vulnerability could let attackers run malicious instructions on a device by getting it to process a booby-trapped file, an ordinary-looking file deliberately altered to exploit a security weakness when your phone processes it
The attack warning concerns CoreGraphics, software that helps Apple devices process and display visual content.
Tracked as CVE-2026-86950, the flaw allowed information to be written outside an intended area of memory, potentially enabling an attacker's code to run.
Apple said the issue 'may have been exploited in an extremely sophisticated attack against specific targeted individuals' on versions of iOS before iOS 27.
The company credited Meta Product Security with reporting the vulnerability and said it fixed the problem by improving checks on memory boundaries.
Security researchers at Calif separately demonstrated that a PDF containing a specially crafted font could trigger memory corruption.
Their analysis raised a possible connection to WhatsApp, but did not establish how the real attacks were delivered. calif.io
That distinction matters, as Apple's advisory does not confirm that this flaw alone gave hackers complete control of an entire phone.
The camera and information-leak vulnerabilities are separate issues, with no exploitation warning attached to either in this advisory.
Apple also released iPadOS 18.7.11 for the seventh-generation iPad, according to its security releases list.
To install the update, first back up your iPhone using iCloud or a computer, then plug it into power and connect to Wi-Fi.
Open Settings, tap General, then Software Update.
The screen shows the software version currently installed and whether an update is available.
If iOS 18.7.11 is offered, tap Download and Install and follow the instructions, entering your passcode if requested.
Allow the installation to finish, then revisit Software Update to confirm the phone is running the updated version.
The number offered can differ on newer devices, so install the latest compatible update shown for your model rather than searching specifically for iOS 18.7.11.
Apple's latest releases also include iOS 27.2 and iOS 26.7.2 for supported newer iPhones.
Apple recommends keeping software current as an important protection for its products.
If there is insufficient storage, Apple says the phone may offer to temporarily remove apps to make room.
Choosing Continue allows that process, and the apps are automatically reinstalled after the update finishes.
Users who cannot see or install the update wirelessly can follow Apple's instructions for updating through a computer.
To reduce the chance of missing future fixes, return to Software Update, choose Automatic Updates and enable automatic installation.
Apple says this allows updates to install overnight while the device is charging and connected to Wi-Fi.
However, checking manually is useful when a security fix has just been released.
The practical step for affected owners is straightforward: check the software version and complete the available installation promptly.