Apple has released security updates for iOS and macOS that address a large number of vulnerabilities, and it has also pushed a fix for an exploited CoreGraphics zero-day to older iPhones running iOS 18. For businesses using Apple devices for work, the update is primarily a reminder that mobile and desktop patching remains a core part of cybersecurity operations.

What happened

According to SecurityWeek, Apple patched 286 vulnerabilities across iOS and macOS 27.2. The report also says Apple backported a fix for an exploited vulnerability in CoreGraphics to iOS 18, extending protection to older supported devices.

CoreGraphics is a core Apple framework used to process and render visual content. Vulnerabilities in components like this can matter because they may be triggered through files, images, documents or app content, depending on the technical details of the flaw.

The source report states that the vulnerability had been exploited. Based on the information provided, that means organisations should treat the update with higher urgency than a routine bug-fix release.

Why it matters for European businesses

Many European SMEs, agencies, e-commerce teams and corporate staff rely on iPhones, iPads and Macs for email, messaging, document handling, customer communication and access to cloud systems. When a vendor fixes a vulnerability that has already been exploited, delayed patching increases exposure on devices that may have access to business data and accounts.

For companies with bring-your-own-device policies or mixed fleets of managed and unmanaged Apple devices, patch adoption can be uneven. That creates a practical security gap, especially where staff use smartphones for authentication apps, password managers, CRM access or internal collaboration tools.

The backport to iOS 18 is also operationally important. It suggests that organisations should not assume only the newest OS branch matters. Older but still supported devices may also need immediate attention.

Who may be affected

• SMEs using Apple devices for day-to-day work: especially where phones and laptops are used to access business email, cloud storage and SaaS platforms.
• IT and security teams: particularly those responsible for mobile device management, endpoint policies and patch compliance.
• E-commerce and marketing teams: if staff use Apple devices to manage storefronts, ad accounts, analytics or customer communications.
• Founders and senior staff: executive devices often hold privileged access and can be attractive targets.
• Regulated businesses: organisations with stronger security and incident-response obligations may need to document timely patching of critical endpoints.

What companies should consider

• Prioritise the updates: review affected iPhones and Macs and schedule deployment as soon as practical, especially for internet-facing, executive or high-access devices.
• Check older supported devices: confirm whether devices running iOS 18 have received the backported fix and are not excluded from update policies.
• Use device management controls: where possible, enforce OS update compliance through MDM or endpoint management tools.
• Review BYOD exposure: if staff use personal Apple devices for work access, verify minimum OS requirements and conditional access rules.
• Focus on privileged users: update devices used by administrators, finance teams and leadership first, because compromise of these accounts can have broader business impact.
• Keep patch communication simple: tell employees why the update matters and set clear deadlines for installation.

While the source report does not provide full technical exploitation details, the combination of a large patch set and a fix for an exploited vulnerability is enough for businesses to treat this as a meaningful endpoint security update rather than a routine maintenance release.