Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Mobile & Wireless

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.

By

Eduard Kovacs

| October 27, 2026 (7:49 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Apple on Monday released updates for its operating systems, addressing a total of 286 vulnerabilities across the newest versions of iOS and macOS. In addition, the company has backported the fix for an exploited vulnerability to iOS 18.

macOS Golden Gate 27.2 resolves 263 vulnerabilities while iOS and iPadOS 27.2 fix 163 flaws. Roughly 140 of the security holes are shared across the two operating systems.

The iOS and iPadOS 27.2 updates address many memory corruption bugs in WebKit, the kernel and components that handle images, fonts, PDFs, audio and video files, some of which could be exploited for arbitrary code execution.

Apple also resolved flaws that could let apps access sensitive user data or bypass privacy preferences, along with WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give a nearby attacker access to a Thread network.

macOS Golden Gate 27.2 patches more than a dozen privilege escalation flaws that could give apps root access, as well as sandbox escapes, Gatekeeper bypasses and kernel memory corruption issues in file system and disk image components.

The update also fixes numerous security holes in Screen Sharing, Remote Management and SMB that can be targeted remotely or from the local network, including a Remote Management bug that could allow a remote attacker to execute arbitrary code.

Advertisement. Scroll to continue reading.

iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, which had been exploited as a zero-day in what Apple described as an “extremely sophisticated attack.”

The vulnerability, discovered by Meta’s product security team, was first patched by Apple in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. iOS and macOS 27 do not appear to be affected.

There does not appear to be any public information detailing the attacks exploiting CVE-2026-86950.

Apple on Monday also released iOS and iPadOS 26.7.2, which fix 134 vulnerabilities, macOS Tahoe 26.7.2, which patches 213 vulnerabilities, and macOS Sequoia 15.8.2, with 197 flaws patched.

The tech giant also released tvOS 27.2 (72 vulnerabilities patched), watchOS 27.2 (62 vulnerabilities), visionOS 27.2 (125 vulnerabilities), and Safari 27.2 (33 vulnerabilities).

Related: Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks

Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Related: AI Slop Limits Apple Bounties

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • PHP2Shell Exploitation Moves From Probes to Working Shells
  • Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
  • Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  • Atlassian Patches 75 Flaws in Data Center and Server Products
  • Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
  • Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  • Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
  • Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Latest News

  • Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
  • This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
  • Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
  • Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
  • Industrial Vendors Check Products for PHP2Shell Vulnerabilities
  • Genesys Hack Exposes Customer Data From Internal Systems

Trending

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

PHP2Shell Exploitation Moves From Probes to Working Shells

SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024

953 Online Stores Infected in Long-Lasting Malware Campaign

Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Genesys Hack Exposes Customer Data From Internal Systems

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Cequence Security has appointed Russ Schafer as CMO.

Mona Harrington has been named Assistant Director for Cyber Integration at DHS.

iCOUNTER has appointed Mark H. FitzPatrick as CFO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)