If your iPhone or iPad is still running iOS 26, iPadOS 26, or iOS 18, Apple has an important security update for you. The company released iOS 26.7.2, iPadOS 26.7.2, iOS 18.7.11, and iPadOS 18.7.11 on October 26 alongside iOS 27.2. One of the repaired flaws may already have been used in an “extremely sophisticated” attack against specifically targeted people, according to Apple’s security advisory.

The practical takeaway is simple: people who have not moved to iOS 27 should not assume they have been left without a critical patch. Open Settings > General > Software Update and install the newest version offered for your device.

The actively exploited flaw

The most urgent fix is tracked as CVE-2026-86950. Apple says a maliciously crafted file could trigger an out-of-bounds write and lead to arbitrary code execution. In everyday terms, a specially prepared file could cause the device to run code chosen by an attacker.

Apple says it is aware of a report that the issue “may have been exploited” in a highly sophisticated attack against specific individuals on versions of iOS before iOS 27. That wording does not suggest a broad campaign against every iPhone owner, but it does confirm that this is more than a theoretical bug. Installing the patch closes the known route before it can be reused more widely.

Who should install iOS 18.7.11?

Apple lists iOS 18.7.11 for the iPhone XS, iPhone XS Max, and iPhone XR, with iPadOS 18.7.11 available for the 7th-generation iPad. The update contains three published security fixes, including CVE-2026-86950. It also addresses an issue that could let an app leak sensitive information and another that could let a malicious app access the camera without permission.

Owners of those devices should install the update even if everything appears to be working normally. Security patches often correct flaws with no obvious symptom, and waiting for a crash, warning, or suspicious pop-up is not a reliable way to know whether a device is protected.

iOS 26.7.2 fixes far more than one bug

For devices staying on the iOS 26 generation, Apple’s iOS 26.7.2 and iPadOS 26.7.2 advisory lists more than 130 CVE identifiers. The fixes span major parts of the operating system, including the kernel, WebKit, Bluetooth, camera access, media processing, fonts, PDFs, and privacy controls.

Among the documented risks are malicious apps accessing Bluetooth without consent, bypassing privacy preferences, reaching sensitive data, or accessing the camera without permission. Apple also repaired memory-safety problems that could corrupt kernel or app memory, plus flaws triggered by crafted images, videos, audio, fonts, PDFs, and other files. A WebKit issue could allow a remote attacker to escape the browser’s WebContent sandbox.

Not every listed vulnerability is easy to exploit, and installing the update does not mean your device was previously compromised. The size and breadth of the patch list do make postponing the update a poor tradeoff, especially for a phone or tablet used for banking, work, health data, or account recovery.

Which update should you choose?

• Already on iOS or iPadOS 27: install iOS 27.2 or iPadOS 27.2, which Apple released on the same day.
• Staying on iOS or iPadOS 26: install version 26.7.2 as soon as it appears.
• Using an iPhone XS, XS Max, XR, or 7th-generation iPad: install version 18.7.11.

You do not need to guess which package fits. Software Update checks the model and currently installed software, then offers a compatible release. Apple’s security releases page confirms that all three update branches were published on October 26.

How to update safely

Apple recommends backing up first, connecting the device to power and Wi-Fi, then opening Settings > General > Software Update. Tap Download and Install and follow the prompts. If storage is tight, iOS may offer to temporarily remove apps and reinstall them after the update. Apple provides the full process in its official update guide.

Afterward, return to Software Update and confirm the new version number. It is also worth opening Automatic Updates and enabling automatic installation for both operating-system updates and system files. This release is a good reminder that even an older software branch can receive a high-priority fix—and that installing it promptly is the safest choice.