iOS 26.7.1 Security Update: What It Fixes, Who Should Install It and How

iOS 26.7.1 is a security update Apple released on 28 September 2026 for iPhones that haven’t moved to iOS 27, and it fixes a flaw Apple says may already have been used in real attacks. If your iPhone is still on iOS 26, install iOS 26.7.1 (or move to the latest iOS 27 release) as soon as you can: go to Settings › General › Software Update. The update is small, it doesn’t change how your phone looks or works, and it closes a hole that could let a booby-trapped file run code on your device.

This guide explains what the update fixes in plain language, who is most at risk, which iPhones and iPads can install it, whether you should choose iOS 26.7.1 or jump to iOS 27, and what to do if you’re buying a used iPhone that’s stuck on an old version.

What does iOS 26.7.1 fix?

According to Apple’s security notes, as reported by 9to5Mac, iOS 26.7.1 fixes one vulnerability, tracked as CVE-2026-86950. Here are the key facts:

Apple released iOS 27.0.1 the same day for iPhones already on iOS 27. That update mainly addressed bugs on the new iPhone 18 Pro models; see our iOS 27 problems and fixes guide if you’re on the newer version.

CVE-2026-86950 explained simply

You don’t need to be a security engineer to understand why this one matters.

What is CoreGraphics?

CoreGraphics is the part of iOS that draws and processes 2D graphics: images, PDFs, shapes and text on screen. Almost every app relies on it, including Messages, Mail, Safari, Files and Photos. That makes it an attractive target, because a bug there can often be reached simply by getting your phone to display a file.

What is an out-of-bounds write?

Programs set aside specific areas of memory for specific jobs. An out-of-bounds write happens when code writes data past the edge of the area it was given, spilling into memory it shouldn’t touch. A skilled attacker who can control what spills over can sometimes make the phone run their own instructions. That’s what Apple means by “arbitrary code execution”.

How could it be used?

Apple’s description says the trigger is a maliciously crafted file. In practice that could be an image, document or similar file sent to you or loaded by an app. Apple hasn’t published technical details of the attack, and it usually doesn’t until most users have updated. We won’t guess beyond what Apple has said.

Who is being targeted?

Apple says the attack was “extremely sophisticated” and aimed at “specific targeted individuals”. Attacks described this way are typically expensive and used sparingly against people such as journalists, activists, politicians, executives and others with access to sensitive information. For most people, the realistic risk is low today.

That said, “low today” isn’t a reason to wait. Once a patch is public, other attackers can study the difference between the old and new code and try to rebuild the exploit. Installing the update removes that risk entirely for this bug.

If you’re worried your phone has already been compromised, our guide on how to tell if your phone is hacked covers the signs that actually matter and the ones that are usually harmless.

Which iPhones and iPads can install iOS 26.7.1?

According to 9to5Mac’s summary of Apple’s release notes, iOS 26.7.1 supports iPhone 11 and later. On the iPad side, iPadOS 26.7.1 covers models including the iPad 8th generation and later and iPad mini 5th generation and later, along with other supported iPad Air and iPad Pro models; check Apple’s security release page for the exact list for your iPad.

Because iOS 27 also supports iPhone 11 and later, every iPhone that can get iOS 26.7.1 can also move to iOS 27. Our iOS 27 supported iPhones list has the full breakdown.

Should you install iOS 26.7.1 or update to iOS 27?

Apple’s note says the possible exploitation concerned versions before iOS 27, so installing iOS 26.7.1 or moving to the latest iOS 27 release both get you off the versions Apple flagged. The right choice depends on how you use your phone.

Choose iOS 26.7.1 if…

• You rely on an app, accessory or work setup that hasn’t been confirmed to work with iOS 27 yet.
• You have an older phone, such as an iPhone 11, and want to wait for early iOS 27 bugs to be ironed out.
• Your employer manages your phone and hasn’t approved iOS 27.

Choose iOS 27 if…

• You want the newest features, such as the updated Siri.
• You want to stay on the version that gets Apple’s full attention long term. Apple patches the previous major version for a while, but the newest version gets every fix first.
• You’ve read about the early issues and they don’t apply to your phone.

What you should not do is stay on iOS 26.7 or earlier. Delaying a major upgrade is reasonable; delaying a security fix for a bug that’s been exploited isn’t.

How to update to iOS 26.7.1

1. Connect to Wi-Fi and plug your iPhone in, or make sure the battery is above 50%.
2. Open Settings › General › Software Update.
3. If your iPhone is still on iOS 26, the screen may offer both the latest iOS 26 update and an upgrade to iOS 27. Pick the option you want. Apple has offered this choice in recent years; the iOS 27 upgrade is usually listed separately from the iOS 26 update.
4. Tap Update Now (or Download and Install), enter your passcode and let the phone restart.
5. After it restarts, return to Software Update to confirm there’s nothing else waiting.

Turn on automatic updates

In Settings › General › Software Update › Automatic Updates, turn on the options to download and install iOS updates, and turn on Security Responses & System Files. That way smaller security fixes can install without you having to remember.

Update an iPad

The steps are the same on iPad: Settings › General › Software Update. Look for iPadOS 26.7.1.

How to check your iOS version

Go to Settings › General › About and look at iOS Version. If it says 26.7.1, you’re patched on iOS 26. If it starts with 27, you’re on the newer version; keep it current through Software Update.

Lockdown Mode: extra protection for high-risk users

If your job or public profile makes you the kind of person sophisticated attackers go after, Apple offers Lockdown Mode. It’s an optional, extreme protection setting that sharply reduces what attackers can reach. For example, it blocks most message attachment types other than certain images, disables some complex web technologies, and blocks incoming invitations from people you haven’t contacted before.

1. Open Settings › Privacy & Security.
2. Scroll down and tap Lockdown Mode.
3. Tap Turn On Lockdown Mode, then restart the phone.

Lockdown Mode is not meant for everyday users, and some apps and websites will behave differently. It’s also not a replacement for updating; it works best alongside the latest software. You can add exceptions for apps or websites you trust.

Buying a used iPhone stuck on an old iOS version?

Security updates matter when you buy second-hand. A used iPhone on an outdated version isn’t a problem in itself; you can update it after purchase. But it can be a clue that something else is wrong.

Why a seller might not have updated

• They simply never bothered. This is the most common reason and is harmless.
• The phone is activation locked to someone else’s Apple Account, so it can’t be set up and updated normally. See our guide to Activation Lock explained.
• The phone has been reported lost or stolen, or is blacklisted by a carrier.
• The phone is enrolled in a company’s device management and controlled remotely.
• It’s an iPhone XS, XR or older that simply can’t install iOS 26 or 27 any more.

What to check before you pay

1. Dial *#06# to see the IMEI and make sure it matches Settings › General › About and the SIM tray (on models that have one).
2. Run a GSMA blacklist check to see whether the IMEI has been reported lost or stolen.
3. Run an All-in-one basic info check, which includes the Find My status, so you know whether the phone is still tied to someone’s account.
4. For a full history, including warranty, replacement and purchase details, an Apple full GSX report goes deeper.
5. With the seller present, check that Settings › General › Software Update works and that the phone can be updated to iOS 26.7.1 or iOS 27.

Our used iPhone buying checklist walks through every other check in order.

What to do if you already opened a suspicious file

If you received an odd attachment before updating and you’re worried, stay calm. The attack Apple described was targeted, and most people will never encounter it. Then take these steps:

1. Update now to iOS 26.7.1 or the latest iOS 27. Restarting the phone as part of the update also clears many in-memory attacks.
2. Delete the message or file and don’t forward it to anyone.
3. Change your Apple Account password from a device you trust and check Settings › [your name] › Devices for anything you don’t recognise.
4. Turn on Lockdown Mode if you believe you’re a likely target, and consider contacting a digital-security help organisation.
5. If Apple ever sends you a threat notification (by email, iMessage or a banner at the top of your Apple Account page), follow its instructions. Apple sends these when it believes a user has been targeted by state-sponsored attackers.

The bottom line

iOS 26.7.1 is a short, focused fix for a CoreGraphics bug that Apple says may have been exploited against specific targeted people. If your iPhone 11 or later is still on iOS 26, install it today, or move to iOS 27 if you’re ready. Check your version in Settings › General › About, switch on automatic updates, and if you’re buying a used iPhone, confirm it isn’t locked, blacklisted or managed before you worry about which iOS it’s running.