iOS Update Alert: Apple Patches More Than 160 Vulnerabilities

An important warning came from Apple for iPhone users waiting for an iOS update. The company closed more than 160 security vulnerabilities in total with iOS 27.2, iOS 26.7.2 and iOS 18.7.11, released on October 26; A warning was also made that one of the vulnerabilities fixed in old iPhones might have been used in attacks.

According to Apple's security updates page, the three versions were released on the same day. We have previously explained the new features of iOS 27.2 in our iOS 27.2 update news. In this article, we look at the security side, which iPhone should get which version and how to do the update.

This time, Apple released separate updates for three different iPhone groups:

iOS 27.2: iPhone 11 and later. The latest version for anyone using iOS 27.

iOS 26.7.2: iPhone 11 and later. For those who choose to stay on iOS 26 rather than upgrade to iOS 27.

iOS 18.7.11: iPhone XS, iPhone XS Max and iPhone XR. Since these models cannot receive iOS 26 and iOS 27, security patches come via iOS 18.

iPadOS 27.2, iPadOS 26.7.2 and iPadOS 18.7.11 were also released on the same day. Apple also rolled out macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, watchOS 27.2, tvOS 27.2, visionOS 27.2 and Safari 27.2 updates.

There are 163 separate CVE records in Apple's iOS 27.2 security notes and 134 separate CVE records in iOS 26.7.2 notes. Most of the vulnerabilities are errors that can cause applications to crash or access sensitive data without permission. The highlights are:

WebKit: Vulnerabilities in the engine used by Safari and in-app browsers that could allow code to be executed with a specially prepared web page have been closed.

App Store: A bug discovered by Cisco Talos researchers could allow a remote attacker to leave the WebContent sandbox.

Apple Intelligence: A authorization error in iOS 27.2 affecting iPhone 15 Pro and later models could allow a remote attacker to access sensitive data.

Bluetooth and accessories: A bug in AccessorySetupKit could allow a malicious application to access Bluetooth without user consent.

Kernel: Fixed many bugs that could cause an application to crash the system or corrupt the kernel memory.

Apple did not share a note indicating that the vulnerabilities closed in iOS 27.2 and iOS 26.7.2 were actively exploited. Still, a patch of this scale should not be postponed. iOS 27 and iOS 26.7 updates released in September also closed more than 100 vulnerabilities.

The most striking information concerns iPhone XS, XS Max and XR users. According to iOS 18.7.11 notes, the update only fixes three vulnerabilities, but one of them is serious. The vulnerability coded CVE-2026-86950 in the CoreGraphics component can lead to code execution on the device by opening a specially crafted file.

Apple states that it is “aware of a report that this vulnerability may have been exploited in a highly sophisticated attack targeting specific individuals in versions prior to iOS 27.” The same vulnerability was closed with iOS 26.7.1, released at the end of September for newer iPhones; iOS 18.7.11 carries the patch to older models. Two other vulnerabilities could allow an app to leak sensitive information and a malicious app to use the camera without permission.

Attacks targeting old iPhones have been on the agenda frequently lately. DarkSword spyware and attacks targeting iPhones via a single site are recent examples of this. This update should not be delayed, like the previous iOS 18.7.3 patch, for devices that remain on the old version.

You can follow these steps to install the update:

Connect your iPhone to Wi-Fi and make sure it has enough charge.

Open the Settings app, enter the General section.

Tap Software Update.

Press the Update Now or Download and Install button for the version that appears.

Those who use iOS 26 and do not want to switch to iOS 27 can select iOS 26.7.2, which is presented at the bottom instead of iOS 27, on the Software Update screen. In order for the updates to install automatically, it is enough to turn on the Automatic Updates option on the same screen.

If the update does not appear in the list, first check whether your device model is in the list above. Full storage space, poor internet connection, or low battery may also prevent the download. Freeing up space in Settings, General, iPhone Storage, charging the phone, and then trying again often solves the problem.

It is usually not possible to revert to the old version after the update. Apple stops allowing installation of older versions shortly after the new version is released. That's why it's a good idea to make a backup via iCloud or a computer before updating.