iOS 26.7.1 and macOS security update: what to install now

Apple has released security updates for iPhones, iPads and Macs that are still running older software, fixing a flaw it says may already have been used in attacks.

The updates are iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple’s security notes for all four are dated 28 September 2026. Each fixes the same single issue.

What Apple has fixed

The flaw is in CoreGraphics, the part of Apple’s software that handles graphics. It is tracked as CVE-2026-86950, and Apple credits Meta Product Security with reporting it.

Apple’s description of the impact is short: “Processing a maliciously crafted file may lead to arbitrary code execution.” In plain terms, opening or handling a specially made file could let an attacker run their own code on the device.

Apple adds that it “is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Apple describes the fix as an out-of-bounds write issue “addressed with improved bounds checking”.

Apple hasn’t said who was targeted or how the file was delivered. Its wording points to targeted attacks rather than a mass campaign. But once a fix is public, the flaw is known, and devices left unpatched stay exposed. That’s why a fix for a flaw already used in attacks is worth installing promptly, whoever the first targets were.

Which devices need it

Apple’s security releases page lists the updates as available for:

iOS 26.7.1 and iPadOS 26.7.1: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
macOS Tahoe 26.7.1: Macs running macOS Tahoe.
macOS Sequoia 15.8.1: Macs running macOS Sequoia.

Apple’s security releases page doesn’t list a fix for macOS Sonoma or earlier.

iOS 27 and iPadOS 27, released on 14 September, run on iPhone 11 and later, but on a shorter list of iPads. On a comparison of Apple’s two device lists, the iPad Pro 12.9-inch (3rd generation), iPad Pro 11-inch (1st generation), iPad Air (3rd generation), iPad (8th generation) and iPad mini (5th generation) can take iPadOS 26.7.1 but not iPadOS 27. An older iPad kept as a register or check-in tablet is easy to overlook, so check those first.

Apple also released iOS 27.0.1, iPadOS 27.0.1 and macOS Golden Gate 27.0.1 on the same day. Apple lists them as having no published CVE entries, and its note on the flaw refers to attacks on versions of iOS before iOS 27. It hasn’t said whether iOS 27 itself was affected. Apple’s security releases page lists 27.0.1 as the latest version for iPhone, iPad and Mac, so devices already on 27 should take that update too.

How to check and update

iPhone and iPad. Apple’s steps: open Settings, tap General, then Software Update. The screen shows the installed version and any update available. Tap Download and Install. Apple recommends backing up first and connecting to power and Wi-Fi. If a device on iOS 26 is offered iOS 26.7.1, installing it gets the fix without moving to iOS 27. Apple notes that VPN or proxy connections can stop a device reaching its update servers.

Mac. Choose System Settings from the Apple menu, click General, then Software Update. You’ll be asked for the administrator password. Apple says to let the installation finish without putting the Mac to sleep or closing its lid.

Automatic updates. On iPhone and iPad, Settings > General > Software Update > Automatic Updates controls whether updates download and install on their own. Apple says turning on automatic updates is the best way to make sure a device gets all its security updates.

If your devices are managed by an IT provider or through mobile device management, ask them when the update will be pushed, rather than updating each device by hand.

Why it matters for a small team

Phones and tablets now hold much of a small business’s access: email, accounting and banking apps, two-factor codes, and point-of-sale apps. Keeping operating systems patched is one of the Essential Eight controls, and our plain-English guide to the Essential Eight covers how quickly updates should be applied. If you’re also tightening sign-ins, see our guide to setting up two-factor authentication across your business accounts.

Checklist

List every Apple device the business uses. Include staff phones that hold work email or banking apps, and any iPad used as a register or check-in kiosk.
Check the version on each iPhone and iPad. Settings > General > Software Update shows it; anything on iOS 26 or iPadOS 26 needs at least 26.7.1.
Find older iPads that can’t run iPadOS 27. The iPad 8th generation, iPad Air 3rd generation, iPad mini 5th generation and iPad Pro 11-inch (1st generation) and iPad Pro 12.9-inch (3rd generation) need iPadOS 26.7.1.
Update each Mac. System Settings > General > Software Update: install macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, matching the version the Mac runs.
Update devices already on version 27. Install iOS 27.0.1, iPadOS 27.0.1 or macOS Golden Gate 27.0.1, which Apple lists as the latest versions.
Turn on automatic updates. On iPhone and iPad, Settings > General > Software Update > Automatic Updates.
Ask your IT provider or MDM administrator when they’ll push the update. Only if devices are managed through mobile device management.

Download checklist PDF

Sources 6 sources

What Apple has fixed

Which devices need it

How to check and update

Why it matters for a small team

Checklist

The week in digital, every Friday

Related stories

The Essential Eight for small businesses, in plain English

How to check a supplier invoice before you pay it

How to set up two-factor authentication across your business accounts