Apple patches 329 vulnerabilities, backporting zero-day fixes to legacy devices

Key points

• Apple addressed 329 unique security vulnerabilities across iOS 27.2, macOS Golden Gate 27.2, and other operating systems, totaling 1,265 CVE listings.
• A CoreGraphics out-of-bounds write flaw (CVE-2026-86950) was backported to older devices running iOS 18 and iPadOS 18, which had previously been patched in September.
• Apple confirmed that CVE-2026-86950 was exploited in 'extremely sophisticated' targeted attacks against specific individuals on pre-iOS 27 devices.
• Notable fixes include a CoreMedia issue allowing unauthorized camera access (CVE-2026-86990) and an Apple Intelligence vulnerability exposing sensitive user data (CVE-2026-86987).
• Apple credited AI tools and research teams for identifying several vulnerabilities in the latest updates, continuing a trend of AI-assisted security discovery.

Background

Apple released version 27.2 updates for iOS, macOS, and other platforms on October 26, 2026, focusing on Siri AI expansion and interface changes. This security update follows previous patches in September that addressed the same CoreGraphics vulnerability for newer devices. The current release extends these critical fixes to older hardware, including iPhone XS and iPad 7th generation models.

How outlets are covering it

9to5Mac highlights the sheer volume of fixes, noting 329 unique vulnerabilities and the role of AI tools in uncovering them. BleepingComputer emphasizes the critical nature of the backported CoreGraphics zero-day, detailing its exploitation in targeted attacks and the specific devices now covered. Both sources agree on the severity of the CoreGraphics flaw but differ in focus: 9to5Mac provides a broad overview of all fixes, while BleepingComputer zooms in on the zero-day's impact and historical context of exploited vulnerabilities.

Why it matters

The backporting of zero-day patches to older devices is crucial for users who cannot upgrade to the latest OS versions. The confirmed exploitation of CVE-2026-86950 in targeted attacks underscores the ongoing threat landscape for Apple users, particularly those on legacy hardware. Additionally, the inclusion of AI-discovered vulnerabilities signals a shift in how security flaws are identified and addressed.

What to watch

Apple may continue to update its security advisories as new entries are added or existing ones are refined. Users on older devices should prioritize installing the backported patches to mitigate the risk of targeted attacks. Apple may also release further updates to address any newly discovered vulnerabilities, especially given the increasing use of AI tools in security research.