iOS 26.7.2 Is Out: What Apple Patched and How to Update

Apple released iOS 26.7.2 and iPadOS 26.7.2 on October 26, 2026. It's a security-only update — there are no new features, menus, or design changes — and Apple's own security-content page for the release lists well over 100 individual fixes across the system. Apple shipped it alongside a separate update, iOS 18.7.11 and iPadOS 18.7.11, for older iPhones and iPads that never moved to iOS 26, backporting several of the same fixes, including one for a CoreGraphics flaw Apple says may already have been used in a real attack. Here's exactly what changed, which devices are covered, and how to install it.

iOS 26.7.2 release date and what it actually is

iOS 26.7.2 and iPadOS 26.7.2 arrived on October 26, 2026. Apple's security updates index lists the release the same day as its companion update for older devices, and both show up as "security fixes" rather than feature updates in Apple's changelog language. If you open Settings and see iOS 26.7.2 waiting, don't expect anything to look different afterward — Apple's release note for it is the standard one-liner: the update "provides important security fixes and is recommended for all users." There is no new Lock Screen option, no new Siri behavior, no new app. That's by design — Apple reserves feature work for the next numbered release (iOS 27 is already the current major version for newly sold iPhones) and uses the .7.x branch purely to keep already-shipped iOS 26 devices patched.

Why Apple is still patching iOS 26 at all

iOS 27 is already the current major release for new iPhones, and iOS 27.2 — itself a security update fixing more than 160 vulnerabilities, including issues in Apple Intelligence and WebKit — came out on the very same day as iOS 26.7.2, October 26, 2026. Apple runs two tracks in parallel for a while after every major release: a feature-and-security branch for people who've moved to the new version, and a security-only ".7.x" branch for everyone who hasn't upgraded yet. This is the third ".7" patch for the iOS 26 branch: iOS 26.7 landed September 14, 2026 (alongside iOS 27 itself), iOS 26.7.1 followed on September 28 with the CVE-2026-86950 fix, and iOS 26.7.2 is the third installment, released October 26. None of the three added features — each one exists purely so that iPhone and iPad owners who skip the jump to iOS 27 still get the same security protection as everyone else.

What iOS 26.7.2 and iPadOS 26.7.2 actually fix

Apple's security-content document for iOS 26.7.2 and iPadOS 26.7.2 is long: it credits dozens of outside researchers and lists well over 100 distinct CVE identifiers, touching components across the OS — Audio, AVEVideoEncoder, CoreGraphics, CoreMedia, WebKit, Wi-Fi, Bluetooth, the App Store client, and many lower-level frameworks most users never see. Apple doesn't publish a single running total on the page itself, but by our count of the individual entries it lists, the number clears 130. Independent coverage lines up with that scale; Beebom's write-up of the release described it as shipping "over 100 security fixes" for iPhones still on the iOS 26 branch.

Two of the entries worth knowing about: CVE-2026-112610 and CVE-2026-112611, both in CoreGraphics, are described by Apple as memory-corruption bugs that could be triggered by "processing a maliciously crafted PDF file." Unlike the CoreGraphics bug discussed below, Apple's page does not say either of these was exploited before the fix — they're serious, but there's no indication anyone used them in the wild. Most of the rest of the list reads the same way: real vulnerabilities, patched before (as far as Apple has said) anyone weaponized them.

The list also shows how much of this work comes from outside researchers rather than Apple's own team. Entries are individually credited throughout — for example, a fix in the AVEVideoEncoder component is attributed to multiple outside researchers, and a separate App Store fix carries its own named credit. That's standard practice for Apple's security bulletins and part of why a single point release can bundle together triple-digit numbers of fixes: each one started life as a separate report, went through Apple's product security team, and landed in the same build once ready, rather than shipping the moment any individual fix was finished.

Should you be worried about any of this?

For the vast majority of the fixes in iOS 26.7.2 and iPadOS 26.7.2, the honest answer is no more than usual. Apple's page does not flag any of the 26.7.2-specific entries as having been exploited before the patch — that's different from, say, a zero-day disclosure, where attackers are already using a bug before a fix exists. Most of these are the result of responsible disclosure: a researcher finds an issue, reports it privately, and Apple fixes it before it's ever used against anyone. The one exception in this whole story is CVE-2026-86950, and it's only relevant if you're on one of the four device models still running iOS 18. If you're already on iOS 26.7.x or iOS 27.x, that particular hole was closed back in September.

The other update: iOS 18.7.11 and iPadOS 18.7.11

At the same time, Apple published a second, separate security update — iOS 18.7.11 and iPadOS 18.7.11 — for the small set of devices that can run iOS 18 but were never eligible for iOS 26: iPhone XS, iPhone XS Max, iPhone XR, and the 7th-generation iPad. Apple's security-content page for that release is much shorter, listing just three CVEs, but one of them is the headline here.

The three fixes in iOS 18.7.11 and iPadOS 18.7.11:

• CVE-2026-65339 (Audio) — an app could potentially leak sensitive user information.
• CVE-2026-86950 (CoreGraphics) — processing a malicious file could lead to arbitrary code execution; see below.
• CVE-2026-86990 (CoreMedia) — a malicious app could access the camera without the user's permission.

In other words, Apple didn't just patch its newest software and move on. It went back and fixed the same underlying bugs for people stuck on older hardware that can't take iOS 26 at all.

Why CVE-2026-86950 matters more than the others

CVE-2026-86950 isn't new. Apple first disclosed and patched it about a month earlier, on September 28, 2026, in iOS 26.7.1, iPadOS 26.7.1, and the corresponding macOS updates — a fix Pandromeda covered at the time. The bug (tracked as CVE-2026-86950 in the National Vulnerability Database) is an out-of-bounds write in CoreGraphics, and Apple's advisory language says the company is "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals" — standard Apple phrasing for a bug used in targeted spyware-style attacks rather than mass exploitation.

Because iPhone XS, iPhone XS Max, iPhone XR, and the 7th-generation iPad were still running iOS 18 at the time and weren't covered by that September fix, the vulnerability stayed open on those devices for roughly a month. iOS 18.7.11 closes that gap. If you're on one of those four devices and skipped software updates recently, this is the one to install — it's the same hole that was reportedly already used against real targets, just finally patched for your hardware.

Which update applies to your device

Apple is running two parallel security tracks right now, and which one you get depends entirely on which iOS generation your device supports:

If your iPhone or iPad already offered you iOS 26 at some point, you'll be offered 26.7.2. If your device maxes out on iOS 18 — because Apple never made it eligible for iOS 26 — you'll be offered 18.7.11 instead. Either way, Settings will show you the correct one; you don't need to figure out which branch you're on manually.

How to update to iOS 26.7.2 (or iOS 18.7.11)

The process is the same regardless of which version Settings offers you:

1. Back up your device (iCloud or a computer) before installing any update, as a general precaution.
2. Connect to Wi‑Fi and plug into power, or make sure you have plenty of battery.
3. Open Settings > General > Software Update.
4. Tap Update Now (or Install Now if it's already finished downloading).
5. Enter your passcode if prompted, and let the device restart.

Apple's own walkthrough, including fixes for common update failures, is at Update your iPhone or iPad. Because this is a security update rather than a major release, the download is typically smaller and installs faster than a full version jump like iOS 26 or iOS 27 did.

No, there's nothing new to look at

It's worth repeating plainly: iOS 26.7.2 and iOS 18.7.11 add zero user-facing features. If you're looking for what's new in Apple Intelligence, Siri, or the interface, that work has gone into the numbered releases — Pandromeda has separate coverage of what Apple Intelligence actually does and of interface changes like Dynamic Island if that's what you're after. This release is purely defensive: it closes holes that security researchers and, in at least one case, real attackers, already found.

What to do now

Given that one of the patched bugs (CVE-2026-86950) has reportedly already been used against targeted individuals, and that Apple has now made the fix available across both the current and legacy branches, there isn't a strong reason to delay. Practically:

• If Settings offers you iOS 26.7.2 or iPadOS 26.7.2, install it when convenient — there's no feature trade-off to weigh, only the security benefit.
• If you're on an iPhone XS, iPhone XS Max, iPhone XR, or 7th-generation iPad and Settings offers iOS 18.7.11, treat that one as higher priority rather than something to put off, since it closes the same previously-exploited CoreGraphics flaw.
• If your device is eligible for iOS 26 or iOS 27 and you've been staying on an older major version deliberately, this patch doesn't change that calculus — it's compatible with staying on iOS 26 long-term, since Apple is clearly still maintaining that branch.
• Keep automatic updates turned on (Settings > General > Software Update > Automatic Updates) so fixes like this install without you needing to track every Apple security bulletin.

Written byNadia Osei

Nadia Osei covers mobile and consumer gadgets for Pandromeda: smartphones, tablets, smartwatches, earbuds and smart-home devices. She tracks launches, software updates and pricing across Apple, Google, Samsung and the rest, and builds comparisons from the manufacturers' published specifications.

More from Nadia OseiAll Mobile & Gadgets coverage