GoKawiilApple fixes CoreGraphics zero-day used in targeted iPhone attacks
Apple has issued security updates for CVE-2026-20700, an out-of-bounds write flaw in its CoreGraphics framework that was used in what the company calls an 'extremely sophisticated' attack against specific individuals. The bug, found by Meta Product Security, affects iOS, iPadOS, macOS, watchOS and tvOS, and could let a malicious file trigger arbitrary code execution. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.