iOS 18.7.11 is a security update for iPhones that cannot run newer versions of iOS, and it fixes a flaw that Apple says may already have been used in attacks. Apple released it on October 26, 2026, together with iPadOS 18.7.11, for the iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation), according to its security releases page.

The exploited CoreGraphics bug

The serious fix is in CoreGraphics, the framework iOS uses to draw graphics, text and images. Apple’s security notes for iOS 18.7.11 describe it as an out-of-bounds write: processing a maliciously crafted file may lead to arbitrary code execution. The bug is tracked as CVE-2026-86950 and was reported by Meta Product Security.

Apple adds its standard warning for actively used flaws. It is “aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Apple does not say who was targeted, who ran the attack or how the malicious file reached the phone.

This is not a new bug. Apple fixed the same CVE on September 28 in iOS 26.7.1 and iPadOS 26.7.1, the update for the iPhone 11 and later. The October release brings the fix to owners of the older models, who were left on iOS 18. For background on what “exploited before a fix” means, see our explainer on what a zero-day vulnerability is.

Two more fixes

The update also closes two other holes, neither marked as exploited:

  • Audio (CVE-2026-65339): an app may be able to leak sensitive user information. Apple fixed a logic issue with improved checks.
  • CoreMedia (CVE-2026-86990): a malicious app may be able to access the camera without user permission. Apple fixed an access issue with improved restrictions.

Apple’s iOS 18 update notes describe the release only as one that “provides security fixes for your iPhone.” There are no new features.

The rest of the October 26 releases

iOS 18.7.11 was one of a batch. The same day Apple published security updates including iOS 27.2, iOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, watchOS 27.2, visionOS 27.2 and Safari 27.2, all listed on the security releases page. If you run iOS 26 on an iPhone 11 or later, you already got the CoreGraphics fix in September; iOS 26.7.2 carries a separate set of fixes.

How to install it

Apple’s update guide gives the steps. Back up the device, plug it in and connect to Wi-Fi, then open Settings, tap General, tap Software Update and choose Download and Install. Under Automatic Updates in the same menu you can have the phone install updates overnight while it charges.