Apple's iOS 26.6.1 Patches 29 Security Flaws, None Yet Exploited

Apple pushed out iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 on Monday, August 17, closing out 29 security vulnerabilities across its device lineup. This is Apple's third security release in three weeks, according to MacRumors.

None of the 29 flaws are known to have been exploited by attackers before the patch, according to Apple's security support document. Now that Apple has published the details, every unpatched iPhone, iPad, and Mac out there is a known target.

What's Actually Broken

The bulk of the fixes, 21 of the 29 CVEs, hit WebKit, the engine that runs Safari and every third-party browser on iOS, according to MacRumors and Forbes. Most of those bugs let maliciously crafted web content crash Safari or corrupt memory. idropnews described it this way: these start as crashes and, mishandled, become a foothold for something worse.

Three vulnerabilities affect the kernel, where Apple warns a remote attacker or malicious app could kill the system or corrupt memory. There's also an audio bug that could let an app leak sensitive user information, and, according to 9to5Mac, additional patches touching ImageIO.

CVE-2026-65346, an integer overflow in ImageIO, merits particular attention. Adam Boynton, Senior Enterprise Strategy Manager at Apple device management provider Jamf, told ZDNET this is the release's "standout fix." ImageIO is Apple's system framework for decoding images. Boynton said exploiting it "could allow an attacker to write memory where they shouldn't and gain code execution."

MacRumors also flagged a telephony bug on iOS that could let an attacker in a privileged network position bypass IPSec authentication and intercept network traffic—a detail some of the other coverage skipped entirely.

Why the Pace Has Picked Up

Apple credited nine of the 29 fixes to OpenAI's Codex Security, an AI tool companies use to hunt down vulnerabilities in their own code, according to ZDNET. Macworld put it bluntly: you can blame AI for finding these bugs or thank AI for helping fix them, but either way, the volume of security updates this year is a real escalation over prior years.

Forbes reported that Apple has been shipping these fixes earlier in its release cycle than in past years, tying the accelerated pace to what Reuters described in July as a response to "AI-driven security concerns." The fixes in 26.6.1 were originally rolled into the iOS 27 and iPadOS 27 developer betas before Apple backported them to the current shipping software, according to MacRumors and idropnews.

Older Devices Get Covered Too

Apple also released iOS 18.7.10 and iPadOS 18.7.10 for iPhones and iPads too old to run iOS 26. Macworld reported that update carries almost 100 security fixes total, far more than the 26.6.1 release, because it covers ground that hasn't been patched in longer.

Boynton's warning to ZDNET applies squarely here: exploit research consistently shows attackers reusing known vulnerabilities against older software long after current hardware gets patched. If you're running an iPhone XS or similar older-era device, installing 18.7.10 promptly matters as much as, if not more than, the 26.6.1 update does for newer phones.

Apple did not release equivalent updates for macOS Sequoia or macOS Sonoma, according to MacRumors, meaning Mac users stuck on those older operating systems because their hardware can't run macOS Tahoe are not covered by this round of patches.

Coverage differs slightly on the exact vulnerability count. ZDNET, Forbes, and MacRumors all cite 29 CVEs total across the release. Macworld's count lands closer to 20 for the iPhone-specific WebKit-heavy list, a gap likely explained by different outlets counting the macOS-only fix separately, since macOS 26.6.2 patches one vulnerability that doesn't apply to iOS at all.

What to Do Now

The install path is the same across every device: on iPhone or iPad, go to Settings, General, Software Update. On a Mac, System Settings, then the same path. Forbes reported the download ran about 704MB and took roughly 15 minutes start to finish on an iPhone 17 Pro Max, though your mileage will vary depending on how recently you last updated.

iOS 27 is expected to arrive in mid-September, based on Apple's typical release pattern cited by 9to5Mac and Mashable. Whether Apple squeezes in one more iOS 26 patch before then is an open question. Given the pace of the last three weeks, don't rule it out.