Loading story…
Apple released watchOS 26.6 for Apple Watch Series 6 and later, patching a broad set of security vulnerabilities across WebKit, Kernel, WebRTC, SceneKit, CoreAudio, ImageIO, MediaRemote, AVEVideoEncoder, CloudAttestation, and Wi‑Fi. The update addresses impacts including denial of service, information disclosure, arbitrary code execution, sandbox escape, kernel memory corruption, root privilege gain, and code-signing bypass, with attack paths ranging from malicious apps and crafted media to hostile web content, nearby attackers, local network attackers, and malicious accessories or servers. Apple said the fixes included improved memory handling, bounds checking, input validation, authorization checks, state management, HTTPS enforcement, and removal of vulnerable code.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Apple released its watchOS 26.6 security advisory for Apple Watch Series 6 and later, disclosing a broad set of fixes across components including Kernel, WebKit, CoreAudio, ImageIO, MediaRemote, CloudAttestation, and Wi‑Fi. The advisory describes impacts ranging from denial-of-service and data exposure to sandbox escape, root privilege gain, kernel memory corruption, arbitrary code execution, and code-signing bypass.
Apple-published CVE records for several vulnerabilities affecting Safari/WebKit and other Apple platforms were published, including issues later noted as fixed in watchOS 26.6. The records cover flaws such as memory corruption, use-after-free, sandbox bypass, and clipboard hijacking across Apple product lines.
Apple updated several additional CVE records tied to vulnerabilities fixed in watchOS 26.6, including CVE-2026-39872, CVE-2026-43676, CVE-2026-43699, CVE-2026-43705, CVE-2026-43701, CVE-2026-43734, and CVE-2026-43726. The updates cover WebKit-related memory safety and sandbox issues affecting multiple Apple platforms.
Apple updated the CVE records for CVE-2026-43707 and CVE-2026-43721, reflecting the vulnerability information tied to fixes in watchOS 26.6 and other Apple releases. These records describe a malicious web content crash issue and a clipboard hijacking issue, respectively.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesupport.apple.com
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **iOS 18.7.7**, **iPadOS 18.7.7**, and **watchOS 26.4** to address a wide range of vulnerabilities affecting supported iPhones, iPads, and Apple Watch Series 6 and later. The patches cover core components including **Kernel**, **WebKit**, **Security**, **CoreMedia**, **CoreUtils**, **Audio**, **802.1X**, and **UIFoundation**, with Apple warning that successful exploitation could enable network traffic interception, denial of service, unauthorized access to sensitive data, installed-app enumeration, Keychain access, kernel memory disclosure, and in some cases kernel memory write or Activation Lock bypass.
Jun 29, 2026
Apple released security updates for **iOS 26.6.1**, **iPadOS 26.6.1**, **macOS 26.6.2**, **visionOS 26.6.1**, and legacy **iOS/iPadOS 18.7.10**, addressing a broad set of vulnerabilities across supported platforms. Reporting on Apple’s advisories indicates the updates collectively fix more than 100 flaws, with roughly 29 to 30 issues documented for the current-generation iOS, iPadOS, and macOS releases and a much larger set rolled into the backported updates for older devices. Apple said it is not aware of any of the vulnerabilities being actively exploited, but urged users to update because public disclosure raises the risk of attacks against unpatched systems. The patched issues span **WebKit**, the kernel, **ImageIO**, **CoreAudio**, **APFS**, **Telephony**, Wi‑Fi, Contacts, and other components, with impacts including arbitrary code execution, information disclosure, denial of service, memory corruption, sandbox escape, and cross-origin data exfiltration. One notable iOS flaw in `Telephony` could allow an attacker in a privileged network position to bypass **IPsec** authentication and intercept traffic, while Apple’s documentation also lists numerous WebKit bugs and an image-based code execution issue. Several findings were credited to AI-assisted security research, including nine CVEs attributed to **OpenAI Codex Security**, and Apple said some visionOS vulnerability details would be published separately.
Aug 31, 2026
Apple released **Safari 26.5** for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in **WebKit** and **WebRTC** that could be triggered by malicious web content. The flaws could allow **Content Security Policy bypass**, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings. Apple also shipped updates for older devices—**iOS 16.7.16**, **iPadOS 16.7.16**, **iPadOS 17.7.11**, and **iOS/iPadOS 15.8.8**—to address **`CVE-2026-28950`** in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to **26.5 or later**.
Jun 29, 2026