Apple patches critical zero-day vulnerability as SlowMist warns of crypto wallet threats

Apple released iOS 26.7.1 on September 28 to address a critical zero-day vulnerability (CVE-2026-86950) in the CoreGraphics engine, which allows for arbitrary code execution via malicious files. While Apple noted the flaw has been exploited in targeted attacks, cybersecurity firm SlowMist has separately been tracking a wave of iOS-based attacks targeting crypto wallet data. The update is available for iPhone 11 and later models, as well as recent iPad and macOS versions.