Apple Patches 163 Security Vulnerabilities in iOS 27.2
Apple released iOS 27.2 and iPadOS 27.2 on October 26, patching a total of 163 vulnerabilities across multiple system components, sbbit.jp reported. The update addresses bugs located in the kernel, WebKit, Wi-Fi, and ImageIO. These flaws could potentially trigger app crashes, sandbox escapes, privacy protection bypasses, or arbitrary code execution on devices ranging from the iPhone 11 onward.
Active Exploitation Disclosed in Legacy iOS 18.7.11 Update
While the main iOS 27.2 software build contains no mention of active exploitation, Apple quietly applied a critical fix to an older operating system branch. The company published iOS 18.7.11 and iPadOS 18.7.11 on the same day to resolve three specific issues for legacy hardware, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad. One particular flaw within the CoreGraphics rendering engine, cataloged as CVE-2026-86950, received a stark warning. Apple stated that it holds reports indicating this specific vulnerability was actively exploited in targeted, highly sophisticated attacks against specific individuals on software versions prior to iOS 27. Processing a maliciously crafted file via this vector could allow an attacker to run arbitrary code.
Industry Researchers and Tech Giants Credited in Vulnerability Disclosures
Meta’s Product Security team was officially credited with discovering the CVE-2026-86950 zero-day flaw patched in the legacy software. Meanwhile, the massive list of 163 vulnerability finders attached to the iOS 27.2 release features prominent names from across the tech industry. Researchers from OpenAI’s Codex Security, Anthropic’s research team, Google Project Zero, and Meta’s Red Team X all contributed bug reports. Alongside the flagship iPhone and iPad updates, Apple pushed out a broad sweep of parallel software versions on October 26, including iOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2.
