Filed under: Cybersecurity · Mobile Patching · September 2026
What happened
On September 28 Apple released emergency updates for a flaw in the part of iPhones, iPads, and Macs that draws images and PDFs (CVE-2026-86950). Opening a booby-trapped file can let an attacker run their own code on the device. Apple says the flaw may already have been used in an “extremely sophisticated attack” against specific people, and CISA added it to its list of actively exploited vulnerabilities on September 29. Devices already on iOS 27 or macOS Golden Gate 27 are not affected; the fix is for devices still on the previous versions.
Why it matters to your business
The attacks so far were narrowly targeted, but now that the flaw is public, other criminals will try to copy it, and older devices that never get updated will be what they go after. In most Phoenix small businesses, the iPhone is where company email, Microsoft 365 or Google Workspace sign-ins, banking apps, and MFA codes all live. Plenty of those phones are still on iOS 26 because their owners haven’t tapped “upgrade” to iOS 27, and those are exactly the phones this fix is for. One compromised phone can give an attacker a way into your email and accounts.
What to do this week
1) On every iPhone and iPad, go to Settings > General > Software Update. Anything on iOS/iPadOS 27.0.1 is fine. If you’re staying on iOS 26, make sure it says 26.7.1. 2) On Macs, go to System Settings > General > Software Update. You’re safe on macOS Golden Gate 27.0.1, Tahoe 26.7.1, or Sequoia 15.8.1. 3) Turn on Automatic Updates (same menu) so the next fix installs without anyone having to remember. 4) Remind staff who use personal iPhones for work email to update too. If you use Intune, Google endpoint management, or another device management tool, set a minimum OS version so out-of-date phones can’t reach company email. 5) Phones older than the iPhone 11 can’t get this fix, so it’s time to replace them.
The bigger picture
Phones get attacked as often as laptops now, but they rarely get the same patching attention. The businesses that stay safe are the ones that check updates on a schedule, not only after a scare. → Proactive vs. Reactive IT Management: Lessons from Healthcare for SMBs
Do you know which iOS version every phone with your company email is running? Book a free consult → https://micro1tech.com/contact/