Apple Addresses Security Flaw in iPhones and iPads
Apple has recently addressed a significant security flaw affecting iPhones and iPads that may have already been exploited in highly targeted attacks, particularly concerning cryptocurrency users. On September 28, the tech giant announced the patch for CVE-2026-86950, a vulnerability in the CoreGraphics framework that could allow malicious files to execute arbitrary code on affected devices. This flaw was mitigated with the release of iOS 26.7.1 and iPadOS 26.7.1, which included improved measures for bounds checking.
Details of the Vulnerability
The company is aware of reports suggesting that the vulnerability may have been leveraged in sophisticated attacks targeting specific individuals prior to the release of iOS 27. The issue was flagged by Meta Product Security. The Chief Information Security Officer at blockchain security firm SlowMist, 23pds, noted the seriousness of the update since it likely resolves a zero-day vulnerability that had been actively used to compromise user data, particularly cryptocurrency wallet information.
Investigations and Risks
Recent investigations have linked a series of iOS attacks to unauthorized access to sensitive wallet data held by cryptocurrency applications. While SlowMist did not definitively confirm that CVE-2026-86950 was the vulnerability involved in any earlier incidents, it highlighted the ongoing risk for crypto holders. The security firm pointed to incidents like the FomoPeek iOS application, which was scrutinized following reports of cryptocurrency theft and exposure of private keys. Some versions of FomoPeek were found to contain code capable of exploiting vulnerabilities in several iOS versions, enabling attackers to escape sandbox environments and access critical information stored within users’ devices.
Scope and Impact
Notably, Apple has not identified the specific file formats involved in various attacks nor disclosed the method of their distribution. No known hacking group or financial motivation has been attributed to these incidents in Apple’s advisories. The scope of the CVE-2026-86950 vulnerability is not limited to just mobile devices; it extends to Mac systems as well, with fixes issued in macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.
Zero-Day Attack Context
In context, the exploitation of CVE-2026-86950 fits the common definition of a zero-day attack, as it appears attackers had the advantage of exploiting the vulnerability before it became publicly known. However, Apple has refrained from labeling it as such within their advisory. SlowMist’s research into an advanced exploit framework called Darksword indicates that it might have the capability to compromise iOS devices, potentially targeting crypto wallets.
User Recommendations
While Apple successfully rolled out patches to enhance security, users who were previously exposed to vulnerable applications are encouraged to exercise caution. Binance has advised those who had installed the compromised versions of FomoPeek to promptly remove the application, update their iOS, and if needed, create a new wallet on a clean device to safeguard their cryptocurrency.
Conclusion
Understanding that these events are taking place against a backdrop of heightened concern among cryptocurrency investors, particularly about data privacy on iOS devices, it is essential for users to stay updated with security patches and take proactive measures in securing their crypto assets. As of the latest updates, users of devices compatible with the iOS 26 branch can install version 26.7.1 to mitigate the vulnerabilities, although this does not prevent past exposures of sensitive information from earlier breaches. Apple has also not disclosed any details regarding the individuals or specific incidents where this vulnerability may have been exploited.
