STAT Computer Services
Insights · Security

Apple fixed a flaw that was used in attacks. Have you updated?

Apple's September 28 updates close a security hole that was already being used against some people. Here is what to do about it, which takes about two minutes.

By Boyd Burkhardt · October 1, 2026 · 1 min read

On September 28, Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Buried in the release notes is the part that matters: a fix for a flaw Apple says may have been used in "an extremely sophisticated attack against specific targeted individuals."

The flaw is in CoreGraphics, the part of the system that handles images and PDFs. A booby-trapped file could let an attacker run their own code on your device.

Should you worry?

No. Attacks like this are aimed at a small number of specific people, and you are very unlikely to be one of them. But once a fix is public, other attackers study it and go after devices that haven't been updated. So update. It's the easiest security win you'll get all year.

How to update

  • iPhone or iPad: Settings > General > Software Update. Install whatever is offered.
  • Mac: Apple menu > System Settings > General > Software Update. Click Update Now and keep it plugged in until it's done.

Already on iOS 27 or macOS Golden Gate? Install the 27.0.1 update that came out the same day while you're there.

Then let them update themselves

While you're in Software Update, turn on Automatic Updates. On an iPhone or iPad, turn on Automatically Install, and it will install updates overnight while charging. On a Mac, click the Info button next to Automatic Updates and turn on the options, including Security Responses and system files. Next time, you won't have to think about it.

For offices: it's never the computer on your desk that's behind. It's the spare laptop, the shared Mac in the back, and the iPad in the drawer. Check those too.