Apple released iOS 26.7.2 on October 26, and if your iPhone is still running iOS 26, this is your this-week update. The release note says only that it “provides security fixes,” but Apple’s security page lists 134 vulnerability fixes, including five WebKit flaws that could let a malicious web page run code on your phone. On the same day, Apple shipped iOS 18.7.11 for the iPhone XS, XS Max, and XR, and that smaller update carries something more urgent: a fix for a flaw Apple says may already have been used in attacks.
Two updates, two audiences, two different levels of urgency. Here is what is in each, and which one you should install first.
What iOS 26.7.2 actually fixes
The update covers the iPhone 11 and later, with iPadOS 26.7.2 going back to the eighth-generation iPad and fifth-generation iPad mini. By count of Apple’s security page, WebKit, the engine behind Safari and every in-app browser, accounts for 22 entries, five of which could let a crafted web page execute code. ImageIO, which opens pictures, has 16 entries, and the kernel has 14. Two entries touch things owners will recognize: a Siri flaw that let someone holding the phone reach contacts from the Lock Screen, and two CoreGraphics flaws where a booby-trapped PDF could corrupt memory.
No entry on Apple’s page for iOS 26.7.2 carries the note Apple uses for flaws seen in attacks, and MacRumors read the page the same way. That makes this a this-week install rather than a drop-everything emergency, but seven web flaws that can run code still make it a poor idea to wait. A web page is the easiest way to reach a phone, and you do not have to visit a shady site to hit a WebKit bug: any app with an in-app browser uses the same engine.
There are no new features. As 9to5Mac notes, Apple’s feature work has moved to iOS 27, which is why the update sits quietly under the iOS 27 offer in Settings.
The iPhone XS and XR fix arrived four weeks late
iOS 18.7.11 has just three fixes, and the one that matters is in CoreGraphics, Apple’s drawing and file-rendering code: a crafted file could run code on the phone. Apple says it is “aware of a report that this issue may have been exploited” against specific people on versions before iOS 27. The identifier is CVE-2026-86950, the same flaw iOS 26.7.1 patched on September 28, with the same wording and the same credit to Meta Product Security.
That means iPhone 11 owners had the fix 28 days before XS and XR owners did. Apple’s list of security releases shows no iOS 18 update in between: the previous one, iOS 18.7.10, came on August 17. The other two fixes in 18.7.11 stop an app leaking personal data and stop a malicious app using the camera without permission. The seventh-generation iPad gets the same update.
The gap is worth noting, not panicking over. Apple still patching iOS 18 more than a year after iOS 26 left these phones behind is good news for anyone holding an older device. But the four-week delay on an actively exploited flaw is the kind of thing to watch: the next iOS 26 fix will show whether the gap was a one-off or a pattern.
Which update should you install
XS and XR owners should install iOS 18.7.11 straight away. It is the only update in this batch fixing something Apple believes was used in an attack, and those phones were the last to get it. On iOS 26, install 26.7.2 this week: nothing is flagged as exploited, but the WebKit fixes alone justify it.
Both updates are in Settings, then General, then Software Update. On an iOS 26 iPhone, iOS 27 is offered first and the iOS 26 update sits lower down, under Also Available. Tap that one if you want to stay on iOS 26 rather than move to iOS 27. If you did move to iOS 27, iOS 27.2 is already live with its own set of fixes and features, and the pre-update checklist still applies if you have not installed it yet.
Anyone who could be a target, such as a journalist or an activist, can turn on Lockdown Mode under Settings, then Privacy and Security, on iOS 18 as well as iOS 26. Apple’s page says it blocks most Messages attachments other than certain images, video, and audio, which closes off one easy way to deliver a crafted file. Our earlier Lockdown Mode explainer covers what it blocks and what it cannot do, and iOS 27.2 also closed most of the Calif jailbreak chain, if you were following that story.
The bottom line is simple. Old phones still get patches, but they may get them late. Check Software Update today, install what is offered for your phone, and do not let a quiet release note fool you: 134 fixes is not a minor update.
