iOS 27.2 Security Update Fixes 160+ Flaws, Older iPhones at Risk

Hakkı ALKAN

October 31, 2026

Apple’s iOS 27.2 security update, released on October 26, 2026, fixes more than 160 vulnerabilities on iPhone 11 and later, according to Apple’s security notes. Apple shipped iOS 26.7.2 with more than 130 fixes the same day, plus iOS 18.7.11 for the iPhone XS, XS Max and XR, which patches a flaw Apple says may have been exploited in targeted attacks.

Which iPhones Get Which Update

Apple split this round into three iPhone releases, all listed on its security releases page:

• iOS 27.2: iPhone 11 and later, for anyone already running iOS 27.
• iOS 26.7.2: iPhone 11 and later, for users who chose to stay on iOS 26.
• iOS 18.7.11: iPhone XS, iPhone XS Max and iPhone XR, which cannot run iOS 26 or iOS 27.

Matching iPadOS versions arrived alongside them, together with macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, watchOS 27.2, tvOS 27.2, visionOS 27.2 and Safari 27.2. The iOS 27.2 feature changes were covered in our earlier look at the iOS 27.2 release candidate.

What the iOS 27.2 Security Update Fixes

Most of the patched bugs could let an app crash the system or read data it should not reach. The notable entries in Apple’s iOS 27.2 notes include:

• WebKit: several bugs where maliciously crafted web content could lead to arbitrary code execution. WebKit powers Safari and the in-app browsers on every iPhone.
• App Store: a flaw found by Cisco Talos researchers that could let a remote attacker break out of the WebContent sandbox.
• Apple Intelligence: an authorization bug on iPhone 15 Pro and later that could let a remote attacker access sensitive user data.
• AccessorySetupKit: an issue that could let a malicious app access Bluetooth without user consent.

Apple does not say any of the iOS 27.2 or iOS 26.7.2 bugs were exploited in the wild. In September, iOS 27 and iOS 26.7 also patched more than 100 vulnerabilities.

Why iPhone XS and XR Owners Should Update Now

The iOS 18.7.11 notes list only three fixes, but one is serious. CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta Product Security, could allow code execution through a maliciously crafted file. Apple says it “is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Newer iPhones received the same fix in iOS 26.7.1 in late September.

The other two fixes address an Audio bug that could leak sensitive user information and a CoreMedia bug that could let a malicious app use the camera without permission. Older iPhones have been a frequent target this year, including the DarkSword spyware campaign.

How to Install the Update

Connect to Wi-Fi, make sure the battery is charged, then open Settings, General, Software Update and tap Update Now. Users staying on iOS 26 can pick iOS 26.7.2 from the same screen instead of upgrading to iOS 27. Turning on Automatic Updates installs future patches without manual steps. If the update does not appear, check that your model is supported and free up storage in Settings, General, iPhone Storage. Apple usually stops signing older versions soon after a release, so back up to iCloud or a computer before updating.