Loading story…
Apple released security updates for iOS 18.3, iPadOS, macOS, watchOS, tvOS, and visionOS that remediate five vulnerabilities in the AirPlay wireless streaming protocol reported by Oligo Security. The flaws include input-validation, type-confusion, memory-handling, and null-pointer-dereference defects that could cause denial of service, application or system termination, process-memory corruption, and, in one case, arbitrary code execution.
The iOS and iPadOS release also fixes a broad set of authentication, logic, and memory-safety issues affecting components including Photos, backup restoration, Bluetooth, and web-content processing. Apple warned that CVE-2025-24085, a malicious-application privilege-escalation flaw affecting versions before iOS 17.2, may have been actively exploited; Oligo withheld AirPlay technical details during coordinated disclosure.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Apple made a further update to the security-content document for iOS 18.3 and iPadOS 18.3.
Apple published patches for CVE-2025-24132, a stack-based buffer overflow in the AirPlay SDK affecting wireless CarPlay-related devices. Oligo Security demonstrated that the flaw could enable remote code execution with root privileges on multiple affected devices, while reporting that no car manufacturer known to it had deployed the patch.
Apple updated the security-content document for iOS 18.3 and iPadOS 18.3, adding or revising vulnerability information.
Apple released security updates for macOS, iOS, iPadOS, watchOS, tvOS, and visionOS, including fixes for five AirPlay vulnerabilities reported by Oligo Security. The iOS 18.3 and iPadOS 18.3 release also addressed numerous other issues, including CVE-2025-24085, a privilege-escalation flaw Apple said may have been actively exploited against iOS versions before 17.2.
Oligo Security discovered multiple vulnerabilities in Apple’s AirPlay protocol, including flaws that could enable denial of service, memory corruption, application termination, or potential arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
oligo.security
Open sourceoligo.security
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple issued security updates across its ecosystem to address **multiple vulnerabilities** affecting *iOS, iPadOS, macOS, tvOS, watchOS,* and *visionOS*, with impacts including **remote code execution (RCE)**, denial of service, elevation of privilege, information disclosure, data manipulation, and security restriction bypass. HKCERT highlighted **CVE-2026-20700** as a **high-risk** issue and noted it is **being exploited in the wild**; the flaw is described as an **improper restriction of operations within the bounds of a memory buffer** that could allow arbitrary code execution when an attacker has memory-write capability. Apple’s iOS 26.3 and iPadOS 26.3 security content includes fixes for issues that could expose sensitive information on a locked device (e.g., **CVE-2026-20645** and **CVE-2026-20674**) and a Bluetooth-related denial-of-service condition where a privileged network attacker could trigger DoS using crafted packets (**CVE-2026-20650**). The updates apply to **iPhone 11 and later** and a range of supported iPad models, and Apple reiterated its policy of publishing details after patches are available.
Jul 23, 2026
Apple released a wide-ranging set of security updates across **iOS**, **iPadOS**, **macOS Tahoe**, **watchOS**, **tvOS**, **visionOS**, **Safari**, and **Xcode**, addressing more than 85 vulnerabilities across core components including the kernel, WebKit, AirPlay, Keychain, and open-source libraries. The updates fix issues that could enable traffic interception, kernel state disclosure, user fingerprinting, installed-app enumeration, Mail privacy bypasses, exposure of deleted Notes content, and crashes from out-of-bounds writes. Apple said it had no reports of in-the-wild exploitation for the vulnerabilities listed in the release notes, but urged users to update, with particular importance for older devices and managed macOS environments. Among the patched flaws is **`CVE-2024-27828`**, a high-severity memory-handling bug in **IOSurfaceRoot** that could let a local app trigger a kernel panic or execute arbitrary code with kernel privileges. STAR Labs said the issue stemmed from a reference count leak in `IOSurfaceRootUserClient::s_create_shared_event`, where repeated calls with crafted input could corrupt memory handling; the flaw affected iOS and iPadOS before 17.5, tvOS before 17.5, watchOS before 10.5, and visionOS before 1.2. Apple addressed the bug through improved memory handling, adding it to a broader pattern of fixes spanning both current and legacy Apple platforms.
Jul 1, 2026
Apple released security updates for **iOS 26.6.1**, **iPadOS 26.6.1**, **macOS 26.6.2**, **visionOS 26.6.1**, and legacy **iOS/iPadOS 18.7.10**, addressing a broad set of vulnerabilities across supported platforms. Reporting on Apple’s advisories indicates the updates collectively fix more than 100 flaws, with roughly 29 to 30 issues documented for the current-generation iOS, iPadOS, and macOS releases and a much larger set rolled into the backported updates for older devices. Apple said it is not aware of any of the vulnerabilities being actively exploited, but urged users to update because public disclosure raises the risk of attacks against unpatched systems. The patched issues span **WebKit**, the kernel, **ImageIO**, **CoreAudio**, **APFS**, **Telephony**, Wi‑Fi, Contacts, and other components, with impacts including arbitrary code execution, information disclosure, denial of service, memory corruption, sandbox escape, and cross-origin data exfiltration. One notable iOS flaw in `Telephony` could allow an attacker in a privileged network position to bypass **IPsec** authentication and intercept traffic, while Apple’s documentation also lists numerous WebKit bugs and an image-based code execution issue. Several findings were credited to AI-assisted security research, including nine CVEs attributed to **OpenAI Codex Security**, and Apple said some visionOS vulnerability details would be published separately.
Aug 31, 2026