Тус компани нь аюулгүй байдлын цоорхойг ашиглан зорилтот халдлага үйлдсэн байж болзошгүйг анхааруулж, хэрэглэгчдийг даруй шинэчлэлт хийхийг зөвлөж байна.
Apple компани CoreGraphics систем дэх “zero-day” буюу өмнө нь илрээгүй байсан аюулгүй байдлын ноцтой цоорхойг илрүүлж, түүнийг засах шинэчлэлтийг даваа гарагт гаргалаа. CVE-2026-86950 гэж нэрлэгдсэн энэхүү эмзэг байдал нь халдагчид хортой файл ашиглан тухайн төхөөрөмж дээр дур мэдэн код ажиллуулах боломжийг олгодог байжээ.
Meta-гийн Бүтээгдэхүүний аюулгүй байдлын баг энэхүү эмзэг байдлыг илрүүлж Apple-д мэдэгдсэн байна. Apple-ийн зүгээс энэхүү цоорхойг ашиглан iOS 27-оос өмнөх хувилбаруудыг ашиглаж буй тодорхой хүмүүст чиглэсэн, өндөр түвшний халдлага үйлдсэн байж болзошгүй гэж үзэж байгаа аж.
Энэхүү алдааг iOS 26.7.1 болон iPadOS 26.7.1 хувилбаруудад хил хязгаарыг шалгах горимыг сайжруулах замаар зассан байна. Шинэчлэлт нь iPhone 11 болон түүнээс хойших загварууд, мөн iPad Pro, iPad Air, iPad, iPad mini-гийн сүүлийн үеийн загваруудад хамаарна.
Энэ нь Apple-ийн хувьд энэ онд засварласан долоо дахь “zero-day” цоорхой болж байна. Компани халдлагын зорилго, хохирогчдын тоо болон халдлага үйлдэгчийн талаар дэлгэрэнгүй мэдээлэл өгөөгүй бөгөөд хэрэглэгчдийг эрсдэлээс сэргийлж үйлдлийн системээ нэн даруй шинэчлэхийг уриаллаа.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
Apple has patched a CoreGraphics zero-day after warning that attackers may already have used the bug to compromise a small number of carefully chosen targets. The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write flaw in CoreGraphics, Apple’s framework for handling graphics across its operating systems. According to Apple’s advisory, processing a maliciously crafted file could allow an attacker to execute arbitrary code on a vulnerable device. The fruity vendor said it addressed the problem with improved bounds checking, though the bug appears to have made it out into the wild before Apple could squash it. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company said. As is customary when Cupertino encounters the sort of security bug somebody has apparently found useful, further details are thin on the ground. Apple didn’t say who was targeted, how many people were affected, who was behind the attacks, or exactly how the vulnerability was being exploited. However, its choice of words suggests this wasn’t a bug being exploited indiscriminately across the internet, and raises the possibility that it was used as part of a targeted spyware campaign. Meta Product Security reported CVE-2026-86950 to Apple, but neither Apple’s advisory nor Meta has provided further technical details on how the flaw was discovered or the attacks in which it was allegedly used. The fix landed on Monday in iOS 26.7.1 and iPadOS 26.7.1. Apple lists affected devices receiving the update as the iPhone 11 and later, iPad Pro 12.9-inch (third generation and later), iPad Pro 11-inch (first generation and later), iPad Air (third generation and later), iPad (eighth generation and later), and iPad mini (fifth generation and later). Apple specifically says the attacks hit devices running versions of iOS before iOS 27, though it hasn’t said exactly which older releases were targeted. The flaw adds another entry to Apple’s growing collection of vulnerabilities caught being abused before users had a patch, with CVE-2026-86950 landing as the seventh zero-day fixed by the company this year. For anyone still running the affected releases, that leaves the usual less-than-thrilling security advice: install the update rather than waiting to find out exactly what an “extremely sophisticated attack” looks like. ®
