Monthly brief — September 2026

2026-10-06

What changed last month that affects your test devices: an exploited iOS flaw, a critical Android Wi-Fi bug, new OS versions and new phones.

iOS 26.7.1 fixes an exploited CoreGraphics flaw (CVE-2026-86950)

Released September 28. A crafted file could run code on iPhone 11 and later. Apple says it may have been used in an extremely sophisticated attack on targeted individuals. iOS 27.0.1 shipped the same day.

To reproduce or verify the issue you need an iPhone held on iOS 26.7 or earlier, and one on 26.7.1 for regression. Once a device updates, it can't go back.

iOS 27 is out — no iPhones dropped

Released September 14 for the same devices as iOS 26: iPhone 11 and later, including iPhone SE (2nd generation and later).

Your users will be split between iOS 26 and 27 for months. Keep test devices on both.

Android September bulletin: 180 fixes, critical Wi-Fi RCE (CVE-2026-28662)

A Wi-Fi memory-corruption flaw allows remote code execution with no user interaction. Fixes ship in two patch levels: 2026-09-01 and 2026-09-05.

Ask for a security patch level below 2026-09-05 to reproduce, and 2026-09-05 or later to confirm the fix. We check the patch level on every unit.

One UI 9 (Android 17) rolling out to the Galaxy S26

Samsung began the stable rollout on September 16, and widened it in the US at the end of the month.

S26 units still on One UI 8.5 (Android 16) will get scarce quickly. If you need them, ask now.

New: iPhone 18 Pro, iPhone Duo and Galaxy S26 FE

Apple announced the iPhone 18 Pro, 18 Pro Max and iPhone Duo, its first foldable (launching October 23). The Galaxy S26 FE has shipped since September 3 with One UI 9 out of the box.

A foldable iPhone means new screen sizes and folding states for iOS apps. Plan layout testing before your users get it.