Apple releases new security updates: Patching dozens of vulnerabilities across macOS, iOS, and iPadOS

Apple has officially rolled out new security updates for Mac, iPhone, and iPad devices. This release addresses dozens of system vulnerabilities, most of which are tied to WebKit - the company's web browser engine.

Risks from unpatched vulnerabilities

www.ipsip.vn

Unpatchable hardware vulnerability in Apple chips: New opportunities for legacy iPhone jailbreaking

In the tech world, Apple is renowned for its stringent security ecosystem. However, a recent discovery by cybersecurity experts has revealed a critical vulnerability embedded directly within the hardware of legacy iPhone models.

If left unaddressed, these security flaws could allow attackers to execute various unauthorized actions. Specifically, potential risks include:

• Disrupting operations, crashing Safari or active processes.

• Corrupting system memory.

• Leaking private user data and sensitive information.

• Executing sandbox escapes and cross-origin data exfiltration.

Patch details for macOS Tahoe 26.6.2, iOS 26.6.1, and iPadOS 26.6.1

In the macOS Tahoe 26.6.2 update, Apple addressed a total of 28 security flaws. Among these, 21 stem from the WebKit engine - which could cause Safari crashes, memory corruption, or personal data disclosure.

Apple addressed a total of 28 security defects, 21 of which stem from the WebKit engine

The remaining 7 issues reside in core components such as Audio, ImageIO, IOGPUFamily, and Kernel. Exploiting these components could lead to information disclosure, denial-of-service (DoS), arbitrary code execution, kernel memory corruption or disclosure, or even total system termination.

In parallel, the iOS 26.6.1 and iPadOS 26.6.1 updates fully patch the aforementioned 28 vulnerabilities. Additionally, Apple resolved an authentication flaw in the Telephony component on mobile devices - an issue that could allow attackers to bypass IPSec authentication to intercept and eavesdrop on network traffic.

This round of iOS 26.6.1 and iPadOS 26.6.1 updates is seen as a necessary preparation ahead of Apple's official launch of iOS 27 and iPadOS 27 next month.

Over 120 vulnerabilities patched on iOS 18.7.10 and iPadOS 18.7.10

www.ipsip.vn

DarkSword: The new "nightmare" for iOS users with a highly sophisticated exploit chain

The mobile security landscape has recently been rocked by the exposure of an exploit toolkit named DarkSword.

For older devices, Apple also released iOS 18.7.10 and iPadOS 18.7.10 to fix over 120 security vulnerabilities, including more than 40 WebKit-related issues. Beyond risks of application crashes and data leakage, these flaws also pose potential risks of sandbox escape and cross-origin data exfiltration.

Notably, this update resolves up to 18 vulnerabilities in the system Kernel. If exploited, these flaws could lead to kernel memory corruption or disclosure, memory overwriting, network filter bypasses, system state leakage, or unauthorized access to user data.

Numerous other components and features also received patches in this rollout, including: Accessibility, AirDrop, App Store, AVEVideoEncoder, Contacts, CoreAudio, CoreMedia, Foundation, ImageIO, IOSkywalkFamily, Maps, MediaRemote, Model I/O, SceneKit, Siri, and WebRTC.

Recommendations for users

Although Apple has not reported any active exploitation in the wild for this release, cybersecurity risks remain ever-present. Users are strongly advised to proactively update their devices to the latest versions as soon as possible. Technical details for each patch are publicly available on Apple's security support page.

---

Reference:

Dozens of WebKit vulnerabilities patched with fresh macOS, iOS security updates - SecurityWeek