Apple patches iPhone flaw used in 'extremely sophisticated' attacks, crypto wallets at risk

Apple (Nasdaq: AAPL) released an emergency-grade security update on Sept. 28, and this one is not routine, the company says the flaw it fixes may already have been used in real attacks, and a blockchain security firm is warning that crypto wallet holders have particular reason to install it.

The update, iOS 26.7.1 and iPadOS 26.7.1, closes a vulnerability tracked as CVE-2026-86950 in CoreGraphics, the framework iPhones and iPads use to render images.

Related: Google, Apple's new job postings go viral

A malicious file is all it takes

In plain terms, the bug let a specially crafted file, such as an image, write data outside the patch of memory it was assigned, a class of flaw known as an out-of-bounds write.

Once an attacker can scribble into memory that doesn't belong to the file, they can corrupt what's there and, in the worst case, run their own code on the device. The victim doesn't need to install anything; processing the booby-trapped file is enough.

Apple said it is "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."

That is the language Apple typically reserves for exploits linked to advanced spyware operations aimed at chosen victims rather than mass campaigns.