Loading story…
Apple issued annual security updates across its operating systems, patching 261 vulnerabilities—its largest annual remediation total reported to date. The fixes span the Kernel, WebKit, SMB, CUPS, ImageIO, SceneKit, Disk Images, and privacy and sandboxing services. Documented impacts include arbitrary code execution, root or kernel privilege escalation, memory disclosure and corruption, sandbox escapes, Gatekeeper and privacy-control bypasses, data exposure, and denial of service through malicious web content and files, network shares and servers, accessories, or local applications.
iOS 27 fixes more than 100 vulnerabilities, while the security-only iOS 26.7 update fixes more than 80, including 75 issues shared with iOS 27; this gives organizations deferring the iOS 27 upgrade a path to remediate many of the same risks. Notable issues include a kernel flaw through which a malicious application could obtain root privileges and a Bluetooth flaw that could permit remote code execution. Apple also released macOS Tahoe 26.7 and macOS Sequoia 15.8 for systems remaining on older macOS versions. No vulnerabilities are known to be actively exploited, but published technical details heighten exposure for unpatched devices; Apple credited Anthropic Claude for three fixes and recognized OpenAI Codex Security.
See real exploitation activity before you spend the cycle.
26 events from the most recent confirmed update back to the earliest known activity.
Tenable published Nessus plugin 346260, a High-severity remote check that identifies Apple TV devices running versions earlier than 27 and recommends upgrading. The plugin covers vulnerabilities in Apple advisory 149036, including CVE-2026-65346, and states that public exploits are available for the covered vulnerability set.
Apple's September 27-series security releases credited collaboration with Claude and Anthropic Research for eight CVEs affecting AVEVideoEncoder, Foundation, SMB, and WebDAV. The flaws include crash, information-disclosure, memory-corruption, and code-execution impacts; CVE-2026-65375 was added as a September 14 amendment to an older Apple security-release page and counted once in the total.
Apple added credits for OpenAI Codex Security to its Safari 26.6.1 security-content advisory for nine unique WebKit vulnerabilities involving memory corruption and out-of-bounds access. Some flaws could crash Safari or WebKit content processes; the same CVEs were also listed in the visionOS 27 advisory.
Apple released Safari 27, fixing six vulnerabilities including the universal cross-site scripting flaw CVE-2026-86898 and information-disclosure issue CVE-2026-64753. Apple also released Xcode 27, fixing CVE-2026-65393, a permissions flaw that could expose sensitive user data; Apple reported no exploitation in the wild.
Apple fixed CVE-2026-64752, a CoreMedia memory-corruption vulnerability that could potentially be triggered when an iPhone processes a malicious image. Rather than patching the flaw in place, Apple removed the affected CoreMedia code; it reported no known exploitation in the wild.
Apple published security content for watchOS 27 affecting Apple Watch Series 9 and later, addressing memory-safety, privacy, sandbox, certificate-validation, networking, and kernel flaws. The advisory includes CVE-2026-84616 and CVE-2026-65414 along with watchOS-specific issues that could enable kernel-memory disclosure or corruption, sensitive-data access, sandbox bypass, arbitrary code execution, and unauthorized system-file modification; Apple did not report active exploitation.
Apple released visionOS 27 security updates for all Apple Vision Pro models, addressing numerous privacy, sandbox, kernel, authentication, archive-handling, networking, and WebKit vulnerabilities. The advisory includes CVE-2026-84616, which could allow a sandboxed app to execute code with kernel privileges, and CVE-2026-65414, a remotely exploitable out-of-bounds write; Apple did not report active exploitation.
Tenable published Nessus plugin 345687 to identify macOS 15.x systems below 15.8 that are missing Apple security update 149043. The Medium-severity, version-based check recommends upgrading to macOS 15.8 or later and reports no known public exploits for the covered vulnerabilities.
Tenable published Nessus plugin 345666 to detect Apple iOS devices running versions earlier than iOS 26.7 and recommend upgrading. The High-severity plugin references Apple advisory 149041 and uses CVE-2026-43715 as its score source (CVSS v3 8.8); it reports no known exploits.
Tenable published Nessus plugin 345685 to identify Apple iOS devices running versions earlier than iOS 27 that are affected by vulnerabilities covered by Apple advisory 149034. The High-severity local-check plugin recommends upgrading to iOS 27 or later and states that no known exploits were available.
Apple released tvOS 27 security fixes for Apple TV 4K (2nd generation and later), addressing numerous memory-safety, authorization, privacy, cryptographic, kernel, and web-content vulnerabilities. The advisory includes flaws that could enable denial of service, sensitive-data disclosure, kernel-memory corruption, arbitrary code execution, unauthorized access, or modification of protected files and network traffic.
Apple's version 27 updates address a remotely exploitable Baseband vulnerability affecting iPhone 11 and later that could cause loss of cellular connectivity, and a Bluetooth flaw that could enable arbitrary code execution. macOS 27 also fixes remotely exploitable issues in Bluetooth, CUPS, the kernel, and smbx; the CUPS flaw could permit arbitrary code execution.
Apple published security content for iOS 26.7 and iPadOS 26.7, disclosing CVE-2026-84607, a race condition that could allow a sandboxed application to execute arbitrary code with kernel privileges. The update also addresses numerous privilege-escalation, privacy, file-handling, kernel-memory, and web-content vulnerabilities affecting supported iPhones and iPads.
Apple disclosed CVE-2026-65414, a critical out-of-bounds write vulnerability (CVSS 9.8) that could allow unauthenticated remote code execution or application termination. Apple fixed the issue through improved bounds checking in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS updates; no exploitation in the wild was reported.
Apple published security content for macOS Golden Gate 27 for supported Apple-silicon Macs, disclosing numerous memory-safety, sandbox-escape, Gatekeeper-bypass, privacy, authorization, network, and privilege-escalation vulnerabilities. The advisory includes flaws affecting Screen Sharing authentication, Apple Intelligence prompts, network-directory path handling, certificate validation, and malicious network shares, images, disk images, archives, and WebDAV servers; Apple reported no active exploitation.
Apple's macOS 27 Golden Gate update addressed CVE-2026-64790, a CUPS flaw that could permit privilege escalation; CVE-2026-43791, a StorageKit validation flaw permitting file reading; and multiple SMB and WebDAV memory-safety flaws. The disclosed issues include SMB kernel-memory disclosure and denial-of-service risks and WebDAV flaws that could permit code execution or application termination.
Apple published security content for macOS Tahoe 26.7, disclosing numerous flaws including sandbox escapes, root- and kernel-privilege code execution, Gatekeeper bypasses, network-share and WebDAV memory-corruption issues, and CVE-2026-43760, which could allow unauthenticated access to Screen Sharing. Apple did not state that any of the listed vulnerabilities were actively exploited.
Apple disclosed CVE-2026-43692, an improper input-validation flaw that could let a remote attacker cause unexpected application termination or execute arbitrary code with user interaction. Apple fixed it through improved input sanitization in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Apple published security details for iOS 27 and iOS 26.7, including kernel flaws that could enable root access and a Bluetooth flaw that could enable remote code execution. Apple said none of the addressed issues were known to be actively exploited and credited three fixes to Anthropic Claude, with additional recognition for OpenAI Codex Security.
Apple released macOS Tahoe 26.7 and macOS Sequoia 15.8 with security fixes for older Macs and users not upgrading to macOS Golden Gate.
Apple released iOS 27 with fixes for more than 100 vulnerabilities and iOS 26.7, a security-only update, with more than 80 fixes. The releases share 75 fixes, providing an update path for users remaining on iOS 26.
Apple released annual updates across its operating systems, introducing new features and patching 261 vulnerabilities, described as the company's largest vulnerability total in a single annual update.
CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalog and confirmed active exploitation. The CVSS 9.8 Screen Sharing Server authentication-bypass flaw affects macOS Golden Gate 27 and macOS Tahoe 26.7 and can let a network attacker authenticate without valid credentials or user interaction.
Apple credited Xint Code for CVE-2026-65355, fixed in visionOS 26.6.1 and capable of revealing a user's IP address despite Private Relay protections, and CVE-2026-65415, fixed in macOS Golden Gate 27. The latter is a kernel race condition that could let a local attacker cause an unexpected termination or read kernel memory.
Apple fixed CVE-2026-43767, an HFS memory-handling vulnerability in macOS Tahoe 26.6, through improved memory handling. The flaw could allow a local attacker to trigger an unexpected system termination, and Apple credited Bynar.io (Bynario) for reporting it.
Apple documented three SMB-related vulnerabilities credited to ThreatBook researchers using XGPT, including flaws that could cause remote crashes or kernel-memory corruption. CVE-2026-39873 was added to an earlier Apple security-release page, while the other two findings were documented for macOS Golden Gate 27.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
37 references tracked. Mallory keeps watching after this page renders.
thezdi.com
Open sourcecyber.gc.ca
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **iOS 26.6.1**, **iPadOS 26.6.1**, **macOS 26.6.2**, **visionOS 26.6.1**, and legacy **iOS/iPadOS 18.7.10**, addressing a broad set of vulnerabilities across supported platforms. Reporting on Apple’s advisories indicates the updates collectively fix more than 100 flaws, with roughly 29 to 30 issues documented for the current-generation iOS, iPadOS, and macOS releases and a much larger set rolled into the backported updates for older devices. Apple said it is not aware of any of the vulnerabilities being actively exploited, but urged users to update because public disclosure raises the risk of attacks against unpatched systems. The patched issues span **WebKit**, the kernel, **ImageIO**, **CoreAudio**, **APFS**, **Telephony**, Wi‑Fi, Contacts, and other components, with impacts including arbitrary code execution, information disclosure, denial of service, memory corruption, sandbox escape, and cross-origin data exfiltration. One notable iOS flaw in `Telephony` could allow an attacker in a privileged network position to bypass **IPsec** authentication and intercept traffic, while Apple’s documentation also lists numerous WebKit bugs and an image-based code execution issue. Several findings were credited to AI-assisted security research, including nine CVEs attributed to **OpenAI Codex Security**, and Apple said some visionOS vulnerability details would be published separately.
Aug 31, 2026
Apple released broad security updates for its platforms, including **iOS**, **iPadOS**, **macOS Sequoia 15.4**, **Safari**, **tvOS**, and **visionOS**, fixing a total of 213 vulnerabilities. The updates addressed 77 flaws in iOS and iPadOS, 123 in macOS Sequoia, and 13 in Safari, with impact ranging from **sandbox escape** and **privilege escalation to root** to **arbitrary file deletion**, **kernel-level code execution**, and **WebKit memory corruption**. Apple also issued fixes for older supported operating systems, backporting patches for vulnerabilities that had been disclosed and reportedly exploited in recent months, including **`CVE-2025-24200`**, **`CVE-2025-24201`**, and **`CVE-2025-24085`**. The company recommended upgrading devices to at least **iOS 15.8.4, 16.7.11, and 18.4**; **iPadOS 15.8.4, 16.7.11, 17.7.6, and 18.4**; and **macOS Ventura 13.7.5, Sonoma 14.7.5, and Sequoia 15.4** to reduce exposure.
Jul 24, 2026
Apple released a comprehensive set of security updates for its major operating systems and applications, including iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, tvOS 26.1, watchOS 26.1, visionOS 26.1, Safari 26.1, and Xcode 26.1. The updates address 110 vulnerabilities, several of which involve memory corruption issues in components such as ImageIO, FontParser, and WebKit, potentially allowing remote code execution. Other vulnerabilities could allow unauthorized access to sensitive user data through components like Spotlight, CoreMedia, MallocStackLogging, Admin Framework, sudo, Security, SoftwareUpdate, and AppleMobile. None of the vulnerabilities were reported as actively exploited at the time of release, and Apple provided limited technical details in its advisories. Security authorities, including the Canadian Centre for Cyber Security, have urged users and administrators to promptly apply these updates to mitigate potential risks. The updates are considered routine but critical, given the breadth of affected products and the potential impact of the vulnerabilities. Users are advised to review Apple's official security update documentation and ensure all devices are updated to the latest versions to maintain security and privacy protections.
Jun 29, 2026