Apple's latest updates, iOS and iPadOS 27.2 and macOS 27.2, fix 286 security vulnerabilities in total. The headline item is a zero-day in CoreGraphics (CVE-2026-86950) that Apple says was used in an "extremely sophisticated attack". Apple has now also brought that fix to older iPhones that can't run iOS 27. If you've been putting off the update, this is the one to install.
Table of Contents
The Numbers
286
- Vulnerabilities fixed across iOS and macOS 27.2
163
- Fixed in iOS and iPadOS 27.2
263
- Fixed in macOS 27.2
~140
- Shared between the two systems
The CoreGraphics Zero-Day
CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the framework iPhones and Macs use to draw images, shapes and text. It was found by Meta's product security team. A specially crafted image or document can corrupt memory and potentially run attacker code. Bugs like this are often used in "zero-click" attacks that need no tap from the victim.
Apple says it was exploited in an extremely sophisticated attack, which usually means targeted attacks against specific people rather than mass campaigns. The fix is in iOS 27.2 and has been backported to iOS and iPadOS 18.7.11 for older devices.
What Else Was Fixed
Many of the other fixes are memory-corruption bugs in WebKit (Safari's engine), the kernel, and components that handle images, fonts, PDFs, audio and video. Some could allow arbitrary code execution, which is why opening a malicious web page or file is a common attack route. For the previous big update, see our coverage of Apple's September 2026 security update.
How to Update
- Back up your iPhone (iCloud or computer).
- Go to Settings › General › Software Update.
- Install iOS 27.2, or iOS 18.7.11 if your device can't run iOS 27.
- Turn on Automatic Updates and Security Responses & System Files so urgent fixes install without waiting.
- Mac users: System Settings › General › Software Update.
Where a VPN Fits
To be clear, a VPN doesn't protect against bugs like this. A malicious image or web page arrives through the encrypted tunnel like any other content. Updating is the only fix. A VPN protects a different layer: it keeps your traffic private on public WiFi and hides your IP. Our guide to what a VPN can and can't protect explains the difference.
Frequently Asked Questions
What does iOS 27.2 fix?
iOS and iPadOS 27.2 fix 163 vulnerabilities, including the actively exploited CoreGraphics zero-day CVE-2026-86950, plus memory-corruption bugs in WebKit, the kernel and media-handling components.
Is there a fix for older iPhones?
Yes. Apple backported the CoreGraphics zero-day fix to iOS and iPadOS 18.7.11 for devices that can't run iOS 27.
Does a VPN protect against the CoreGraphics zero-day?
No. The exploit arrives inside normal content, so a VPN can't block it. Installing the update is the fix.
Sources
- SecurityWeek: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- BleepingComputer: Apple patches CoreGraphics zero-day flaw exploited in attacks
- eSecurity Planet: Apple Fixes 163 iPhone, iPad Flaws in iOS 27.2 Update
Update First, Then Encrypt
Patched your phone? Add CarrotVPN on Android to keep public WiFi traffic private. Free, WireGuard®-powered.
Download CarrotVPN Free