Apple patches CoreGraphics zero-day exploited in targeted iOS attacks

Tue, 29 Sep 2026 16:53:02 +0000

Engineer — Act: Actively exploited zero-day in CoreGraphics affecting iOS (and likely macOS per related advisories); update all managed Apple devices to the patched iOS/macOS releases immediately via MDM or manual prompt.
SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet; queue a sweep of MDM inventory to identify unpatched Apple devices among high-value personnel and prepare to triage if Apple releases indicators for this ’extremely sophisticated’ campaign.
Leader — Act: Sophisticated targeted iOS zero-days historically indicate mercenary or state-sponsored spyware against executives and high-value individuals; confirm MDM enforces the patch on corporate Apple devices and brief leadership who use personal iPhones for work on the need to update immediately.

Apple-Security on CuraSec