Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28 with a security patch for a serious vulnerability that could allow attackers to execute arbitrary code on affected devices.
The tech giant said the issue involved an out-of-bounds write in CoreGraphics and added that the flaw could be triggered by processing a specially crafted file.
SlowMist Warns Crypto Users
Apple confirmed that it could have been exploited in a “highly sophisticated attack” against specific targeted individuals on versions of iOS prior to iOS 27.
Meanwhile, SlowMist said the vulnerability is related to the iOS attack activity it tracks. The security firm also warned that crypto users should pay special attention. He urged them to update their Apple devices and avoid suspicious links, files and app installation prompts. Users should also be careful while downloading apps or opening content from unknown sources.
The vulnerability affects a range of Apple devices, including the iPhone 11 and later models, as well as several recent iPad models.
Malicious FomoPeek iOS app
A week earlier, SlowMist reported an iOS-related security threat involving the FomoPeek app. The security company said it received several reports of users losing digital assets and discovered that the affected users had been exposed to a private key. Some had already installed versions 1.1 and 1.2 of FomoPeek.
A joint investigation by SlowMist and OKX security teams discovered malicious code inside the app. According to the investigation, FomoPeek contained an iOS kernel exploitation framework with eight attack methods. The framework could select an exploit based on the device model and iOS version.
Affected versions included iOS 12.0-18.7 and iOS 26.0-26.1. If successful, the exploit could escape the iOS sandbox and access keychain data and files from other apps. This could expose private keys, seed phrases, login credentials, and other sensitive information. Hidden server connections were also found capable of receiving remote commands, with the attack functionality apparently executed automatically at regular intervals.
Earlier this year, Apple was sued by three people for allegedly promoting a fake version of crypto app Sparrow Wallet through its App Store. The fake app allegedly drained a total of $1.8 million from victims’ wallets between May and August 2025.
The post Apple Patches an iOS Flaw That Could Allow Attackers to Run Malicious Code on iPhones appeared first on CryptoPotato.
About the Author
