Apple has extended a fix for an actively exploited iPhone and iPad flaw to older devices that missed the original September update.

• What it is: A CoreGraphics flaw (CVE-2026-86950) where opening a maliciously crafted file can let an attacker run their own code on the device.
• Who is affected: iPhone XS, XS Max and XR, plus iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later, if not yet updated.
• The risk: Apple says it may have been used in extremely sophisticated attacks against specific targeted individuals. Risk to most staff is low, but the fix is free and quick.
• Action needed: Open Settings, General, Software Update, and install the latest update on every company and personal device used for work.

We recommend businesses ask staff to update their iPhones and iPads this week, and enforce updates through device management where it is in place. Source: BleepingComputer.