Apple o'tgan oyda chiqarilgan xavfsizlik yamoqlarini eski iPhone va iPad'lar uchun orqaga ko'chirdi, bu iOS qurilmalariga qarshi "juda murakkab" maqsadli hujumlarda ishlatilgan nol kunlik xatoni tuzatadi.
Apple sentyabr oyida iOS 26.7.1 va iPadOS 26.7.1, macOS Tahoe 26.7.1 va macOS Sequoia 15.8.1 ishlaydigan qurilmalar uchun xuddi shu zaiflikni tuzatgan edi.
Meta Product Security CoreGraphics'dagi bu chegaradan tashqari yozish zaifligini (CVE-2026-86950 sifatida kuzatiladi) aniqladi — bu iOS, macOS, iPadOS, watchOS va tvOS bo'ylab ikki o'lchovli vektor grafikasi, matn chizish va tasvir renderlash uchun ishlatiladigan framework.
Chegaradan tashqari yozish xavfsizlik muammolarining muvaffaqiyatli ishlatilishi hujumchilarga dasturlarni ishdan chiqarish, ma'lumotlarni buzish yoki ajratilgan xotira buferidan tashqarida ma'lumot yozish orqali masofaviy kod bajarilishini olish imkonini beradi.
"Apple bu muammo iOS 27'dan oldingi iOS versiyalarida juda murakkab hujumda aniq maqsadli shaxslarga qarshi ishlatilganligi haqida xabar borligini biladi," deb ogohlantirdi Apple dushanba kuni.
"Zararli tarzda tayyorlangan faylni qayta ishlash ixtiyoriy kod bajarilishiga olib kelishi mumkin. Chegaradan tashqari yozish muammosi yaxshilangan chegaralarni tekshirish bilan hal qilindi."
Bu haftadagi xavfsizlik yamoqlari bilan Apple endi bu zaiflikni iPhone XS, iPhone XS Max, iPhone XR, iPad 7-avlod, iPad Air 4-avlod va undan keyingi, iPad 9-avlod va undan keyingi, hamda iPad mini 6-avlod va undan keyingi qurilmalarda ham tuzatdi.
Apple CVE-2026-86950 faqat yuqori darajada maqsadli hujumlarda ishlatilganini aytgan bo'lsa-da, potentsial hujumlarni to'sish uchun bu orqaga ko'chirilgan yamoqlarni o'rnatish qat'iy tavsiya etiladi.
Bu zaiflik bilan Apple bu yil hujumlarda ishlatilgan ikkita nol kunlik xatoni tuzatdi. Boshqasi (CVE-2026-20700), Apple operatsion tizimlari tomonidan ishlatiladigan Dynamic Link Editor (dyld) dagi ixtiyoriy kod bajarilish zaifligi, shuningdek "juda murakkab" maqsadli hujumlarda ishlatilgan va fevral oyida tuzatilgan.
Yil boshida Apple shuningdek Bluetooth masofasidagi hujumchilarga foydalanuvchilarning suhbatlarini tinglash imkonini beradigan yuqori jiddiylikdagi Beats Studio Buds xatosini (CVE-2025-20701) tuzatdi va Coruna ekspluat to'plami yordamida kiberjosuslik va kripto-o'g'irlik hujumlarida ishlatilgan to'rtta zaiflikka qarshi eski iPhone va iPad'larni yamadi.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% to'siladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS.
Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," Apple warned on Monday.
"Processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking."
With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
With this vulnerability, Apple has fixed two zero-days exploited in attacks this year. The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks, was patched in February.
Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report