Apple has released an emergency iPhone and iPad security update after saying a CoreGraphics flaw may have been used in an extremely sophisticated attack on specific targeted individuals.
Millions of users are being told to install the patch now. The company shipped iOS 26.7.1 and iPadOS 26.7.1 to close a weakness that could let hackers run malicious code through a specially crafted file, the Daily Mail reported.
Apple also put out a separate release, iOS 27.0.1, aimed at bugs hitting the new iPhone 18 Pro and Pro Max. The security fix is the more urgent of the two.
The CoreGraphics flaw sits in software that handles images and related content. A bad file is enough, in Apple’s description, to trigger malicious code on a vulnerable phone or tablet. That is the kind of silent entry point sophisticated operators look for.
Apple did not publish a full incident report. It did state the stakes in plain terms for devices still running software older than iOS 27.
Apple said the weakness:
"may have been exploited in an extremely sophisticated attack against specific targeted individuals"
The company gave no names, no countries, and no spyware labels. It also withheld technical play-by-play on how the reported attack worked. What it did make clear is the audience: not a mass spray at every phone, but a high-end strike aimed at chosen people.
That framing matters. Ordinary users still need the patch. Targeted campaigns often reuse the same bugs once researchers and vendors catch on. Leaving an old build on a phone is an open invitation.
The emergency security build is available for iPhone 11 and newer models still on Apple’s older software line. iPad users are covered across a long list of machines: all 11-inch iPad Pro models; third-generation 12.9-inch iPad Pro and later; third-generation iPad Air and later; eighth-generation iPad and later; and fifth-generation iPad mini and later.
Apple released the security fix just weeks after iOS 26.7. Relative timing is all the company and the report provided. No public calendar date was attached in the account of the rollout.
Installation is the standard path. Open Settings, tap General, then Software Update, and install what appears. Users who prefer not to watch the process can turn on automatic updates so patches land without another reminder.
Alongside the security work, Apple issued iOS 27.0.1 for problems on the new iPhone 18 Pro and Pro Max. Those phones hit shelves in September. User complaints followed soon after.
Reported trouble included random restarts after Face ID failed to authenticate. Some owners saw strange colors in photos at 2x zoom under certain lighting. Others hit a touchscreen freeze when Notification Center and Control Center were opened at the same time. A forced restart could bring a locked-up device back.
Those are stability defects, not the CoreGraphics attack surface. They still stranded premium buyers with phones that rebooted or ignored touches. Shipping a point release this fast shows how quickly hardware-cycle bugs surface once millions of units leave the store.
Apple did not disclose details of the reported attack beyond the “extremely sophisticated” and “specific targeted individuals” language. No CVE number appeared in the account of the fix. No independent confirmation named a culprit group.
That silence is familiar in high-end mobile cases. Vendors patch first and litigate the narrative later, if at all. Customers get a binary choice: update, or keep running a build the vendor has already tied to possible real-world abuse.
For anyone on iPhone 11 or newer still below the new security build, the practical step is the same. Install iOS 26.7.1 or iPadOS 26.7.1. Pro owners chasing the Face ID and display glitches should take iOS 27.0.1 as well.
Sophisticated operators will always hunt the next unpatched hole. The least a user can do is close the one Apple has already flagged.