Loading story…
Apple published multiple security release notes and update entries across its platforms, including iOS/iPadOS point releases (e.g., iOS/iPadOS 26.2.1, 18.7.4, 16.7.13, 15.8.6, 12.5.8) and watchOS 26.2.1, with Apple indicating no published CVE entries for several of the January 2026 point updates. Apple also refreshed or republished detailed historical security-content pages for older products, including macOS Big Sur 11.7.9 (listing fixes such as CVE-2023-34425 kernel-privilege arbitrary code execution in Apple Neural Engine, CVE-2023-32364 sandbox restriction bypass, and other privacy/logic issues), Xcode 14.1 (including multiple git issues such as CVE-2022-29187, CVE-2022-39253, CVE-2022-39260, plus an Xcode Server privilege issue CVE-2022-42797), and visionOS 2 for Apple Vision Pro (including issues like CVE-2024-44126 heap corruption from crafted files, CVE-2024-27876 arbitrary file write via archive unpacking race condition, and additional sandbox/data-access weaknesses).
Separately, a vendor blog post warned that critical WebKit vulnerabilities could enable remote compromise of iOS devices via a malicious webpage (arbitrary code execution and potential credential/data theft), emphasizing patch latency as a key risk; however, the post does not clearly map its claims to specific Apple CVEs or to the “no published CVE entries” iOS/iPadOS point releases listed on Apple’s security releases page. A Reddit /r/netsec item about a one-click vulnerability in IDIS Cloud Manager (ICM) Viewer (triggered by clicking an untrusted link) is unrelated to Apple/WebKit and does not align with the Apple security-release content.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Apple’s security releases listing shows continued patch releases across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, Safari, and Xcode through January 2026. On January 26, 2026, Apple issued several iOS/iPadOS and watchOS point releases, some explicitly noting that no CVE entries were published.
A security warning reported that critical WebKit vulnerabilities could let attackers compromise iPhone and iPad devices through a malicious webpage, potentially enabling arbitrary code execution, credential theft, or access to sensitive data. The report emphasized that slow patch adoption increases exposure.
Apple later updated the visionOS 2 security advisory with additional entries or revisions. The support page indicates subsequent additions on October 28, 2024 and March 3, 2025.
Apple released security information for visionOS 2, detailing multiple vulnerabilities affecting Apple Vision Pro. The fixes covered issues such as heap corruption, arbitrary file overwrite, root-level system file modification, sandbox escapes, denial of service, VPN traffic leakage, Bluetooth access problems, and several WebKit web-origin and XSS-related flaws.
In the macOS Big Sur 11.7.9 security content, Apple said it was aware of reports that CVE-2023-41990 in FontParser and CVE-2023-38606 in the kernel may have been actively exploited against iOS versions released before iOS 15.7.1. This indicated real-world attacker interest in those bug classes.
Apple released macOS Big Sur 11.7.9 with fixes for numerous vulnerabilities across the kernel, AppSandbox, CFNetwork, and bundled third-party components such as curl, OpenSSH, SQLite, Vim, and tcpdump. The update addressed issues including privacy leaks, sandbox escapes, privilege escalation, denial of service, and arbitrary code execution.
Apple published security content for Xcode 14.1, including fixes for multiple Git vulnerabilities by updating to Git 2.32.3 and an Xcode Server privilege-escalation flaw. The Git issues could expose sensitive information from malicious repositories or enable app termination or code execution in some configurations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
zimperium.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple published multiple security advisories across iOS/iPadOS, macOS, and watchOS releases that include fixes for vulnerabilities reported as **actively exploited** in the wild. Notable exploited issues include iOS/iPadOS 15.6.1 fixes for **kernel** and **WebKit** out-of-bounds writes enabling arbitrary code execution (`CVE-2022-32894`, `CVE-2022-32893`), iOS/iPadOS 16.3.1’s exploited **WebKit** type confusion leading to code execution (`CVE-2023-23529`), and iOS/iPadOS 15.7.5 plus macOS Big Sur 11.7.6 addressing an **IOSurfaceAccelerator** out-of-bounds write that could yield kernel-level code execution (`CVE-2023-28206`) alongside an exploited **WebKit** use-after-free (`CVE-2023-28205`). Apple also shipped iOS/iPadOS 16.6.1 and macOS Ventura 13.5.2 updates to remediate an exploited **ImageIO** buffer overflow (`CVE-2023-41064`) and an exploited **Wallet** attachment validation issue that could allow code execution (`CVE-2023-41061`). Separately, Apple’s iOS 17.0.1 and watchOS 9.6.3 advisories describe two vulnerabilities (`CVE-2023-41991`, `CVE-2023-41992`) reported by **Citizen Lab** and Google’s **Threat Analysis Group** as exploited against versions prior to iOS 16.7, involving **signature validation bypass** and **local privilege escalation**. Other referenced advisories (e.g., iOS/iPadOS 16.7, iOS/iPadOS 17.2, iOS/iPadOS 18.1, iOS/iPadOS 18.3, macOS Sequoia 15.1, iOS/iPadOS 26.1, macOS Tahoe 26.1, iOS/iPadOS 26.2) primarily enumerate additional CVEs and privacy/logic/memory-safety fixes but do not clearly tie to the same specific exploited-vulnerability disclosures, indicating they are broader platform security bulletins rather than part of a single incident response.
Jun 29, 2026
Apple released security updates for **iOS 26.6.1**, **iPadOS 26.6.1**, **macOS 26.6.2**, **visionOS 26.6.1**, and legacy **iOS/iPadOS 18.7.10**, addressing a broad set of vulnerabilities across supported platforms. Reporting on Apple’s advisories indicates the updates collectively fix more than 100 flaws, with roughly 29 to 30 issues documented for the current-generation iOS, iPadOS, and macOS releases and a much larger set rolled into the backported updates for older devices. Apple said it is not aware of any of the vulnerabilities being actively exploited, but urged users to update because public disclosure raises the risk of attacks against unpatched systems. The patched issues span **WebKit**, the kernel, **ImageIO**, **CoreAudio**, **APFS**, **Telephony**, Wi‑Fi, Contacts, and other components, with impacts including arbitrary code execution, information disclosure, denial of service, memory corruption, sandbox escape, and cross-origin data exfiltration. One notable iOS flaw in `Telephony` could allow an attacker in a privileged network position to bypass **IPsec** authentication and intercept traffic, while Apple’s documentation also lists numerous WebKit bugs and an image-based code execution issue. Several findings were credited to AI-assisted security research, including nine CVEs attributed to **OpenAI Codex Security**, and Apple said some visionOS vulnerability details would be published separately.
Aug 31, 2026
Apple published security advisories detailing vulnerability fixes across multiple iOS and iPadOS versions, including iOS/iPadOS **16.7**, **17.2**, **18.1**, **18.3**, **26.1**, and **26.2**. The advisories describe a range of impacts such as sandbox escapes (including Web Content sandbox breakout), privacy issues where apps could access or expose sensitive user data via insufficient log redaction, file-system modification via temporary-file handling, and memory-safety flaws (e.g., out-of-bounds reads, type confusion, and bounds-checking issues) that could lead to crashes or memory corruption. Apple attributes fixes to changes like improved protocol handling, cache handling, input validation, and additional permission restrictions, and references issues by **CVE** where available. Several advisories also highlight device-state and authentication/logic weaknesses: iOS/iPadOS 18.3 includes a case where an attacker with physical access to an **unlocked** device could access Photos while the app is locked (`CVE-2025-24141`), while iOS/iPadOS 18.1 includes a lock-screen exposure issue (`CVE-2024-44274`) and a Shortcuts-related path-handling flaw that could allow arbitrary shortcut execution without user consent (`CVE-2024-44255`). The iOS/iPadOS 26.x advisories include privacy and permission issues (e.g., identifying installed apps, screenshots of sensitive embedded views), potential kernel memory corruption/system termination conditions, and logic/UI issues affecting security posture (e.g., passcode requirement timing after Face ID enrollment restore scenarios and potential FaceTime caller ID spoofing), with multiple findings credited to external researchers and teams (including Google Project Zero, ByteDance IES Red Team, and others).
Jun 29, 2026