The iOS 27.2 update reached iPhone 11 and later on 26 October 2026, fixing 163 security flaws. Owners of the iPhone XS, iPhone XS Max and iPhone XR get a different update, iOS 18.7.11, which closes a CoreGraphics hole Apple patched on newer iPhones 28 days earlier. Apple flagged none of the 163 as exploited.
Which Update Your iPhone Needs
There is no single iOS 27.2 update for every iPhone: Apple’s list of security releases records three mobile releases dated 26 October 2026, and which one your phone offers depends on the major version it currently runs.
| Update | Who it is for | Security fixes |
|---|---|---|
| iOS 27.2 and iPadOS 27.2 | iPhone 11 and later, already running iOS 27 | 163 |
| iOS 26.7.2 and iPadOS 26.7.2 | iPhone 11 and later still running iOS 26 | 134 |
| iOS 18.7.11 and iPadOS 18.7.11 | iPhone XS, iPhone XS Max, iPhone XR and the seventh-generation iPad | 3 |
The split matters because the iPhone XS, XS Max and XR cannot run iOS 26 or iOS 27 at all. Those three models stopped at iOS 18, so Apple maintains that line separately, and it is the only one of the three releases that carries a fix for a flaw Apple says was used in a real attack.
As of 28 October 2026, all three updates are available worldwide through Software Update, and Apple has published no advisory withdrawing or pausing any of them.
Why the Fix Counts Differ Between Headlines
Coverage of this release quoted numbers from 130 to 329 because each outlet counted a different set of platforms. Apple does not publish a headline total of its own.
Per SecurityWeek’s per-platform tally of the 26 October advisories, the counts break down like this:
- iOS and iPadOS 27.2: 163 fixes, roughly 140 of them shared with macOS.
- macOS Golden Gate 27.2: 263 fixes.
- iOS and iPadOS 26.7.2: 134 fixes.
- macOS Tahoe 26.7.2: 213 fixes.
- macOS Sequoia 15.8.2: 197 fixes.
- iOS and iPadOS 18.7.11: 3 fixes.
- tvOS 27.2: 72 fixes. watchOS 27.2: 62. visionOS 27.2: 125. Safari 27.2: 33.
The figure of 286 that appeared in some headlines combines iOS 27.2 and macOS Golden Gate 27.2 after removing the overlap. A higher figure of 329, used by the German site Apfelpatient, counts unique flaws across every platform Apple updated that day. For an iPhone owner, 163 is the number that applies.
Within that 163, MacRumors counted more than 30 fixes in WebKit, the engine behind Safari, and about 15 in the kernel. It also reported that six of the identifiers are credited to Calif, the team behind a launch-day iPhone Duo jailbreak, three to Anthropic Research and four to OpenAI.
The CoreGraphics Flaw That iPhone XS Owners Waited 28 Days For
One flaw in this batch was already being used against real people, and only the oldest iPhones were still waiting for the fix. It is tracked as CVE-2026-86950, an out-of-bounds write in CoreGraphics, the Apple framework that draws images and documents. A crafted file can trigger code execution.
Apple’s advisory says it is “aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27. That is Apple’s standard phrasing for a flaw found on a compromised device. Apple has not named the attacker or the victims.
The timing is the part competitors largely skipped. Apple first fixed this flaw on 28 September 2026 in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 — a release this site covered at the time. The iPhone XS, XS Max and XR never received that update, because they cannot run iOS 26. The fix reached them on 26 October, 28 days later.
iOS 18.7.11 carries two further fixes: CVE-2026-65339, a logic flaw in Audio that could leak personal information, and CVE-2026-86990, an access flaw in CoreMedia that could let a malicious app use the camera without permission.
What Else iOS 27.2 Changes
Security is the bulk of this release, but it is not all of it. Apple added Siri AI support in French, Japanese, Korean, Portuguese and Spanish, which TechCrunch reports are shipping in beta form, alongside Suggested Actions in Messages, separate viewer profiles in the Apple TV app, four-stream Multiview for live sport, and a redesigned Apple Music icon.
Two limits carry over unchanged. Siri AI still requires an iPhone 15 Pro or later, an iPhone 16 or later, or an iPhone Air, and Apple’s documentation continues to exclude iPhones in the European Union and accounts in mainland China. The redesigned Health app, pulled from the beta in October, is still absent; Apple has said it will arrive in a later update without naming a version, as covered in our report on the iOS 27.2 release candidate.
How to Install the Update
- Back up first: use iCloud or a computer, so a failed install does not cost you data.
- Connect to Wi-Fi and power: Apple’s own guidance is to update on Wi-Fi with the phone charging.
- Open Settings, then General, then Software Update: the phone will offer whichever of the three releases applies to it.
- Tap Download and Install: if the phone offers both iOS 26.7.2 and iOS 27, you can take the security update on its own and leave the major upgrade for later.
Apple says roughly 80% of iPhone owners are still on iOS 26, which is why the 134-fix iOS 26.7.2 release matters more than its coverage suggests. Staying on iOS 26 is a supported choice; skipping the update is not.
iOS 27.2 Update FAQ
Which iPhones Can Install iOS 27.2?
Apple lists iOS 27.2 as available for iPhone 11 and later. Models older than that, including the iPhone XS and XR, cannot install it.
Do I Still Need an Update if I Stay on iOS 26?
Yes. Apple shipped iOS 26.7.2 the same day with 134 security fixes for people who have not moved to iOS 27. It is a security update, not a version upgrade.
Was Any Flaw in iOS 27.2 Being Used in Attacks?
Apple did not flag any of the 163 as exploited. The one flaw it describes as possibly exploited, CVE-2026-86950, was fixed for newer iPhones in September and reached iOS 18 devices on 26 October.
Why Did My iPhone XS Offer iOS 18.7.11 Instead?
The iPhone XS, XS Max and XR are not supported by iOS 26 or iOS 27, so Apple maintains iOS 18 as a separate security-only line for them. iOS 18.7.11 is the current release on that line.
Does the iOS 27.2 Update Bring Siri AI to Europe?
No. Apple’s documentation still excludes iPhones in the European Union and accounts in mainland China from Siri AI, and Apple has given no timeline for either.
