Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

Apple released emergency updates for a zero-day out-of-bounds write in CoreGraphics (CVE-2026-86950, CVSS 8.8) that is being actively exploited in highly sophisticated targeted attacks; the flaw affects many iPhones and iPads and has been patched in macOS as well. CISA added the CVE to its Known Exploited Vulnerabilities catalog and issued fast remediation and forensic triage requirements for federal agencies, while analysts warn organizations to treat the update as an emergency patch and to bring Apple devices into enterprise security controls.