Apple patches actively exploited iOS zero-day
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR warns that CVE-2026-86950, exploited in the wild, is among 250+ flaws fixed in Apple's October 2026 security updates across iOS, macOS, Safari, tvOS, watchOS and visionOS.
CERT-FR has issued an advisory consolidating Apple's October 26, 2026 security bulletins, which address a very large batch of vulnerabilities across the full Apple software ecosystem: iOS/iPadOS (up to versions 18.7.11, 26.7.2 and 27.2), macOS Golden Gate, Sequoia and Tahoe, Safari, tvOS, visionOS and watchOS. The flaws span memory corruption, logic errors, and other weaknesses that can lead to arbitrary code execution, privilege escalation, data confidentiality breaches, denial of service, and security-policy bypass. Apple has confirmed that CVE-2026-86950 is being actively exploited in the wild, making it the priority patch target for affected organizations, particularly those managing fleets of Apple devices.
Given the breadth of products and CVE count (well over 250 identifiers referenced, including some older CVEs from 2019 and 2022 presumably addressed via updated components), defenders should treat this as a mass-patch event rather than a single-issue advisory. CERT-FR provides no technical details or exploitation specifics beyond confirming active exploitation of CVE-2026-86950; Apple's own bulletins (149225, 149227, 149230, 149521–149527) are the authoritative source for per-product fix details and CVE-to-impact mapping.
Recommended action is immediate deployment of the referenced updates to all iOS, iPadOS, macOS, Safari, tvOS, visionOS and watchOS devices below the fixed versions, with priority given to confirming remediation of CVE-2026-86950 given its confirmed in-the-wild exploitation.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1387
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,359 reports from 144 sources, 627 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs