Originally published at: Apple Patches Zero-Day Exploit Alongside September 2026 OS Fixes - TidBITS
Sometimes, it seems the only thing in common across a bunch of Apple operating system releases is the date. Plus, I missed a few security updates when OS 27 came out because I was recovering from my cycling accident. The releases fall into three categories.
OS 27.0.1
Apple has released iOS 27.0.1, iPadOS 27.0.1, macOS 27.0.1, watchOS 27.0.1, and visionOS 27.0.1. None include security release notes, and each entry on the Apple Security Updates page simply says, “This update has no published CVE entries.”
But they aren’t at all equivalent. iOS 27.0.1 fixes problems with iPhone 18 Pro models unexpectedly restarting when Face ID fails to authenticate, eliminates a color artifact on some photos captured 2x on some iPhone 18 Pro models, and prevents opening Notification Center and Control Center simultaneously from causing the touchscreen to become unresponsive. The macOS 27.0.1 release notes and iPadOS 27.0.1 release notes admit only to “bug fixes,” whereas the visionOS 27.0.1 release notes say “security fixes,” and the watchOS 27.0.1 release notes acknowledge that among its bug fixes is one that could cause the Apple Watch to restart unexpectedly.
Curious. I wonder whether this update also silently fixes the zero-day exploit targeting previous versions of iOS, iPadOS, and macOS—see next. I see no reason not to install these updates right away.
CoreGraphics Zero-Day Exploit
At the same time, Apple updated its older but still-supported operating systems, releasing iOS and iPadOS 26.7.1, macOS 26.7.1 Tahoe, and macOS 15.8.1 Sequoia. In each case, the security notes say:
Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
In other words, the bad guys found a bug in CoreGraphics that’s probably being exploited in spyware like Pegasus. Unless you are a “specific targeted individual,” it’s not essential to rush to install this update, but I still strongly encourage everyone to install it within a few days. One reality of the modern world is that once something is known about a vulnerability, it’s much easier for developers to task an AI with finding it or even another vulnerability like it.
Catch-Up Security Releases
In the rush to cover OS 27, I missed noting iOS and iPadOS 26.7, macOS 26.7 Tahoe, and macOS 15.8 Sequoia, which came out the same day. They contain only security fixes, but considering that iOS and iPadOS 26.7 contain fixes for 82 vulnerabilities, macOS 26.7 addresses 154 vulnerabilities, and macOS 15.8 blocks 155, “only” is doing a lot of heavy lifting there.
If you are still running these older versions, and I’m sure most of you are, I strongly recommend that you update to the latest version to take advantage of these numerous security fixes, along with the CoreGraphics fix that came out subsequently.
That said, several people have reported problems with RAW images in macOS 15.8, so you might want to hold off on that update if you rely heavily on RAW images. Reportedly, macOS 15.8.1 fixes this problem.
