Insights Security & Privacy
Older iPhones XS and XR get a fix for a flaw that may be exploited
The short version
Apple has released iOS 18.7.11 for the iPhone XS, XS Max and XR. It closes a flaw in how the phone handles images and files, which Apple says may have been used in an extremely sophisticated attack on specific people.
What happened
The flaw sits in CoreGraphics, a part of the system that draws images and text. Processing a maliciously crafted file may let an attacker run their own code. Meta Product Security is credited with finding it.
Apple fixed the same problem in September for devices running newer software. This update, released on 26 October, brings the fix to the iPhone XS, XS Max and XR. It also repairs two other flaws: one let an app leak sensitive user information, and one let a malicious app reach the camera without permission.
Why it matters to you
Apple says the attack it knows of was aimed at specific, targeted individuals. Even so, a flaw that may have been exploited is one worth closing.
If you or your staff still use these older iPhones, they stay exposed until the update is installed. Apple's note covers some iPads too.
What to do
On an iPhone XS, XS Max or XR, open the phone's software update settings and install iOS 18.7.11.
If you manage phones for a business, check which staff still use these models and ask them to update.
Sources
- About the security content of iOS 18.7.11 and iPadOS 18.7.11 Apple Support (primary source) (opens in a new tab)
- Apple backports CoreGraphics zero-day patches to older iPhones BleepingComputer (opens in a new tab)
- Apple backports fix for exploited CoreGraphics zero-day The Hacker News (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.