Apple security content for iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (published 28 September 2026; The Hacker News amplified same day) patches CVE-2026-86950 in CoreGraphics: an out-of-bounds write addressed with improved bounds checking. Impact: processing a maliciously crafted file may lead to arbitrary code execution.

Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 — no public detail on volume, success, or first-seen date. Credited to Meta Product Security.

No Apple-published CVSS on the HT pages. Distinct from earlier February 2026 dyld CVE-2026-20700 (also noted as weaponised in sophisticated attacks). Primary: Apple HT149226 / HT149228 / HT149229; wire: The Hacker News 28–29 Sep.

UPDATE 1 Oct 2026 (desk 16:00 Perth): Calif research “The Great Glyph Grift” (Dion Blazakis, Josh Maine, Anna Groza; 30 Sep) publishes patch-diff analysis and a public crash-trigger sample (TrueType/PDF via ImageIO thumbnail path) showing a controlled out-of-bounds write from glyph fixed-point conversion — crash demonstrated on macOS/iOS; authors state turning that into reliable code execution is separate work and they did not obtain the in-the-wild sample. Calif also notes WhatsApp Kaleidoscope (versions 26.37.73→26.38.74) added stricter PDF embedded-font checks, hinting a possible messaging attachment delivery path consistent with Meta Product Security credit — not confirmed as the in-the-wild vector.

CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on 29 Sep (due 2 Oct 2026). Wire: The Hacker News 1 Oct.

UPDATE 2 Oct 2026 (desk 19:00 Perth): WA SOC advisory 20261002001 (TLP:CLEAR) restates CVE-2026-86950 as an out-of-bounds write in CoreGraphics on Apple iOS/iPadOS 26.x prior to 26.7.1 and macOS 15.x prior to 15.8.1 / 26.x prior to 26.7.1, scores CVSS 8.8 High, notes CISA KEV listing, states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing, and recommends Apple HT149226 / HT149228 / HT149229 within expected patch timeframes.