Apple dushanba kuni eski qurilmalarga yuqori darajadagi xavfsizlik zaifligi tuzatishini orqaga tatbiq etdi, bu zaiflik real dunyodagi kiberhujumlarda ishlatilgan edi.
CVE-2026-86950 (CVSS balli: 8.8) sifatida kuzatilgan bu zaiflik CoreGraphics'ga ta'sir qiluvchi chegaradan tashqari yozish (out-of-bounds write) bo'lib, zararli tarzda tayyorlangan faylni qayta ishlashda ixtiyoriy kod bajarilishiga olib kelishi mumkin.
Bu zaiflik uchun tuzatishlar o'tgan oy Apple tomonidan iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 va macOS Sequoia 15.8.1 versiyalarida chiqarilgan bo'lib, kompaniya bu zaiflik iOS 27 dan oldingi versiyalarda ishlaydigan qurilmalardan foydalanuvchi muayyan shaxslarga qarshi murakkab hujumlarda ishlatilgan bo'lishi mumkinligini tan olgan.
Tuzatishlar endi iOS 18.7.11 va iPadOS 18.7.11 ni ham o'z ichiga oladi, bu versiyalar iPhone XS, iPhone XS Max, iPhone XR, iPad 7-avlod, iPad Air 4-avlod va undan keyingi, iPad 9-avlod va undan keyingi, hamda iPad mini 6-avlod va undan keyingi qurilmalarni qo'llab-quvvatlaydi.
"Apple bu muammo iOS 27 dan oldingi versiyalarda ishlaydigan qurilmalarda muayyan maqsadli shaxslarga qarshi o'ta murakkab hujumda ishlatilgan bo'lishi mumkinligi haqida xabar borligidan xabardor," deb aytdi kompaniya.
iOS 18.7.11 va iPadOS 18.7.11 shuningdek Audio'dagi (CVE-2026-65339) mantiqiy muammoni ham tuzatadi, bu ilova tomonidan foydalanuvchining maxfiy ma'lumotlarini ochib yuborish uchun ishlatilishi mumkin, hamda CoreMedia'dagi (CVE-2026-86990) kirish zaifligini ham tuzatadi, bu zararli ilova tomonidan foydalanuvchi ruxsatisiz kameraga kirish uchun suiiste'mol qilinishi mumkin.
Bu yangilanish Apple iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 va Safari 27.2 ni chiqarishi bilan bir vaqtda sodir bo'ldi, bu versiyalar yuzlab zaifliklarni, jumladan AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit va WebKit'dagi ko'plab kamchiliklarni tuzatadi.
Kamchiliklar orasida Apple Intelligence'dagi (CVE-2026-86987) avtorizatsiya muammosi ham bor, bu masofaviy hujumchi tomonidan foydalanuvchining maxfiy ma'lumotlariga kirish uchun ishlatilishi mumkin. iPhone ishlab chiqaruvchisi bu muammo iOS va iPadOS'da yaxshilangan huquq tekshiruvlari bilan hal qilinganini aytdi.
Apple bu zaifliklarning hech biri real dunyoda ishlatilganligi haqida hech narsa aytmasa-da, optimal himoya uchun qurilmalarni eng so'nggi versiyaga yangilash har doim yaxshi amaliyotdir.
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27.
The fixes have now been expanded to include iOS 18.7.11 and iPadOS 18.7.11, which support iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," the company said.
iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339) that could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.
The release comes as Apple shippediOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2, fixing hundreds of vulnerabilities, including many in AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit, and WebKit.
Notable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data. The iPhone maker said the issue was addressed in iOS and iPadOS with improved entitlement checks.
Although Apple makes no mention of any of these flaws being exploited in the wild, it's always a good practice to update the devices to the latest version for optimal protection.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.