The flaw is a CoreGraphics out-of-bounds write that fires when the framework parses a booby-trapped file, and Apple's own advisory uses its careful 'may have been exploited' language — the phrasing it reserves for real zero-days caught in the wild, here against specific individuals on iOS builds before 27. Meta reported it, and it's been tied to an 'extremely sophisticated' targeted attack, the shape of mercenary-spyware work rather than mass exploitation. Fixes shipped September 28 in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. CISA's listing the next day puts a clock on it: under BOD 26-04, federal civilian agencies get three days — until October 2 — to patch and to run forensic triage checking whether they were already hit. You're almost certainly not the target of an attack like this, but 'targeted' bugs get commoditized fast once they're public. If you manage a fleet of Apple hardware, push the update now and don't wait for the KEV deadline to make the call for you.