Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Apple released iPadOS 26.6.1 (build 23G83), a maintenance update applying security fixes to iPads on the iPadOS 26 line.
Apple listed iPadOS 26.6.1 (build 23G83) on August 17, 2026. The release entry contains only download links and release notes, with no CVE identifiers or exploitation details in the announcement. The matching build number with iOS 26.6.1 indicates shared core components updated in tandem across Apple platforms.
Apple released iPadOS 18.7.10 (build 22H374), a maintenance update with security fixes for iPads remaining on the iPadOS 18 branch.
Apple listed iPadOS 18.7.10 (build 22H374) on August 17, 2026. The announcement provides only download links and release notes, with no CVE details or exploitation notes included. The shared build number with iOS 18.7.10 indicates the same legacy-branch security maintenance for older devices not running iPadOS 26.
Apple released iPadOS 27.0 (build 24A437) with no security fixes detailed in the announcement.
Apple published iPadOS 27.0 (24A437) on its developer news feed. The notice only links to downloads and release notes without describing security updates. Security content should be verified in the full release notes.
Apple seeded iPadOS 27.0 release candidate build 24A435 to developers ahead of the general release.
Apple released the iPadOS 27.0 release candidate (build 24A435) via its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
Apple released iPadOS 27.2 beta build 24B5084k to developers for testing.
Apple has published iPadOS 27.2 beta build 24B5084k on its developer release portal, matching the same build number as the iOS 27.2 beta. No security content or vulnerability details are provided in the notice.
Apple released iPadOS 26.6.2 (build 23G90), a minor software update listed on its developer releases page without vulnerability details.
Apple released iPadOS 26.6.2, build 23G90, listed on its developer software releases page dated September 8, 2026. The available page content only provides download links, with no published vulnerability details, CVEs, or change notes in the source text.
Apple released iPadOS 26.7 (build 23H24) on September 9, 2026; the notice lists downloads without describing security fixes.
Apple shipped iPadOS 26.7, build 23H24, made available through its developer downloads page on September 9, 2026. The release announcement provides no description of changes, vulnerabilities, or CVEs. Apple point releases frequently bundle security patches, but none are confirmed in the available text.
Apple seeded iPadOS 27.0 beta 8 (build 24A5430a) to developers, sharing its build number with the same-cycle iOS 27.0 beta 8.
Apple released iPadOS 27.0 beta 8, build 24A5430a, to developers on August 31, 2026. The build number matches the same-cycle iOS 27.0 beta 8, indicating shared platform code across iPhone and iPad. No security fixes or CVEs are disclosed in the release listing.
Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.
Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.
CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.
The Canadian Centre for Cyber Security (AV26-930) notes that as of September 14, 2026, Apple has addressed vulnerabilities in iOS and iPadOS prior to 27, macOS Golden Gate prior to 27, macOS Tahoe prior to 26.7, macOS Sequoia prior to 15.8, plus tvOS, watchOS, visionOS 27, Safari, and Xcode prior to 27. The bulletin provides no CVE identifiers or exploitation details. Users and administrators are encouraged to review Apple's security releases and apply the updates.
Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.
Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.
Apple patched a record 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, including 20 kernel flaws; none exploited in the wild.
Apple's iOS 27 and iPadOS 27 releases fix roughly 126 security flaws, 20 of them in the kernel, while macOS Golden Gate 27 addresses 210 vulnerabilities, about 100 shared with the mobile release. macOS Tahoe 26.7 patches 153 unique CVEs, including 26 kernel defects that could cause memory corruption, privilege escalation, system termination, and information leaks. Notable fixes include CVE-2026-64752, a CoreMedia memory corruption flaw allowing iPhone compromise via a malicious image, and CVE-2022-3437, a heap buffer overflow in Heimdal Samba enabling denial-of-service. Apple states none of the patched flaws are known to be exploited in the wild.
Apple shipped its fully rebuilt Siri running on Google's Gemini models with iOS 27, initially excluding the EU and China over regulatory hurdles.
Apple released 'Siri AI' as an English beta within iOS 27, iPadOS 27, macOS 27, watchOS 27, and visionOS 27, built on Google's Gemini models running partly on-device and partly through Private Cloud Compute. The rollout excludes the EU and China at launch due to regulatory requirements, with French, Japanese, Korean, Portuguese, and Spanish support due next month. Early reviewers call it a step forward but report failures on personal-context queries and occasional hallucinations. Siri integrates with third-party apps like WhatsApp and Audible, with Outlook, Notability, and Tripsy coming later.
Apple released iOS 27 and macOS Golden Gate 27 with a LLM-based Siri AI overhaul powered by new AFM 3 on-device and cloud models.
Apple shipped its 2026 annual OS updates: iOS 27, macOS 27 Golden Gate, watchOS 27, visionOS 27, and tvOS 27. Siri AI is the flagship feature, offering context-aware responses, personal history search, app interaction, and a dedicated Siri app. The stack includes AFM 3 Core (3B parameters on-device), AFM 3 Core Advanced (20B sparse model activating 1-4B parameters), plus AFM 3 Cloud, ADM 3 Cloud (Image), and AFM 3 Cloud Pro server models. Additional features include prompt-generated Shortcuts and Safari extensions, new photo editing options, and a Liquid Glass transparency slider.
Apple released tvOS 27.0 (build 24J361) with no security fixes detailed in the announcement.
Apple published tvOS 27.0 (24J361) on its developer news feed. The notice contains only download and release-note links with no security content described. Any security fixes would be listed in the full release notes.
Apple seeded tvOS 27.0 release candidate build 24J360 to developers ahead of the general release.
Apple released the tvOS 27.0 release candidate (build 24J360) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
Apple's iPhone 18 Pro adds a Reference Image mode that cryptographically signs camera sensor pixels to prove photos were not AI-generated or edited.
Apple will launch a Reference Image mode with the iPhone 18 Pro lineup, using the new camera sensor to sign every pixel and develop the signed data via Private Cloud Compute into an unalterable reference image viewable in Photos. Users can compare the reference image against edited versions to verify authenticity, building on provenance standards like SynthID, C2PA, and Meta's Content Seal. A Reference Image API will span iOS, iPadOS, and macOS for third-party apps, though the feature launches without EU support, arriving there in iOS 27, iPadOS 27, and macOS 27.
An Apple password-management engineer (writing personally) explains switching password managers via iOS direct app-to-app export, crediting FIDO Credential Exchange for passkey portability.
Ricky Mondello, an Apple engineer in password management and authentication (writing personally, not for Apple), demonstrates moving 100 items from 1Password to Apple Passwords via the iOS system export, which transfers passwords, passkeys, verification codes, and notes directly between apps with Face ID confirmation and no intermediate files. He credits the FIDO Alliance's Credential Exchange format (first draft May 2024, now an open spec) and iOS 26/macOS 26 for enabling phishing-resistant credential transfer between apps like 1Password, Bitwarden, Dashlane, DuckDuckGo, and Devolutions. The post is advice rather than news, recommending bulk transfer on the existing device, switching AutoFill to the new app, and treating the new manager as the source of truth.
Apple seeded tvOS 27.2 beta build 24K5088l to developers with no security details disclosed in the release listing.
Apple released tvOS 27.2 beta (build 24K5088l) to developers on September 16, 2026, per its software release listing. The listing contains only download links and a pointer to release notes, with no security content or vulnerability details. It is a routine developer beta with no reported exploitable issues.
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
Apple seeded tvOS 27.0 beta 8 (build 24J5360a) to developers as the annual fall OS release cycle approaches final builds.
Apple released the eighth beta of tvOS 27.0, build 24J5360a, through its developer program on August 31, 2026. The listing contains only download links and release notes with no disclosed security fixes or CVEs. Beta 8 indicates the pre-release cycle is nearing the stable 27.0 rollout.
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.
Apple seeded visionOS 27.0 release candidate build 24M362 to developers ahead of the general release.
Apple released the visionOS 27.0 release candidate (build 24M362) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
A comparison of 12 MDM platforms ranks Microsoft Intune as best value for Microsoft 365 estates and Jamf, Kandji, and Mosyle for Apple fleets.
The buyer's guide compares 12 mobile device management (MDM) products, naming Microsoft Intune best value since it is included in Microsoft 365 E3/E5, and Jamf, Kandji, and Mosyle as Apple specialists with day-one OS support and automated compliance remediation. Eight of the twelve publish rates; per-device pricing punishes multi-device users, while Microsoft, Omnissa, and IBM offer per-user options. Free tiers from Mosyle, Miradore, and ManageEngine support genuine small deployments.
Apple seeded iOS 27.0 beta 8 (build 24A5430a) to developers with no security fixes disclosed in the release listing.
Apple released iOS 27.0 beta 8, build 24A5430a, through its developer program on August 31, 2026. The build number matches the same-cycle iPadOS 27.0 beta 8, indicating shared platform code. No vulnerability information or CVEs are disclosed in the release listing.
A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.
A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.
Apple released macOS 26.6.2 (build 25G83), a point update delivering security patches for Macs on the macOS 26 line.
Apple published macOS 26.6.2 (build 25G83) on August 17, 2026 via its software releases feed. The listing offers downloads and release notes only, without disclosing CVE identifiers or exploitation status. Security-focused point updates for macOS are relevant to enterprise Mac fleets and should be tested and deployed routinely.
A 2026 buyer's guide ranks UEM platforms, recommending Intune for Microsoft 365 shops, Jamf for Apple estates, and SOTI for rugged devices.
The guide ranks ten unified endpoint management platforms for 2026, recommending Microsoft Intune for Microsoft 365 organizations, Jamf for Apple-heavy estates, and SOTI for rugged, kiosk, and industrial devices. It notes VMware Workspace ONE now operates as Omnissa after Broadcom divested the End-User Computing division, and that BlackBerry sold Cylance to Arctic Wolf in February 2025 while retaining BlackBerry UEM. The article provides a coverage checklist spanning Windows, macOS, iOS, Android, Linux, kiosks, legacy on-prem Windows, and wearables/IoT.
Apple shipped visionOS 26.6.1 (build 23O780), a security and maintenance update for Vision Pro headsets.
Apple listed the visionOS 26.6.1 release (build 23O780) on August 17, 2026. The announcement contains only download and release note links, with no CVE identifiers or exploitation details disclosed in the feed text. Updates to visionOS generally bundle security patches alongside functional improvements for Apple Vision Pro.
Apple seeded visionOS 27.2 beta build 24N5088l to developers with no security details disclosed in the release listing.
Apple released visionOS 27.2 beta (build 24N5088l) to developers on September 16, 2026, per its software release listing. The listing contains only download links and a pointer to release notes, with no security content or vulnerability details. It is a routine developer beta with no reported exploitable issues.
Apple released macOS 27.0 (build 26A428) with no security fixes detailed in the announcement.
Apple published macOS 27.0 (26A428) on its developer news feed. The notice only links to downloads and release notes without describing security updates. macOS major releases typically include security fixes detailed in separate notes.
Apple released macOS 27.2 beta build 26B5086k to developers for testing.
Apple has published macOS 27.2 beta build 26B5086k on its developer release portal with downloads and release notes. The notice contains no security advisories or CVE information.
Apple seeded the macOS 27.0 Release Candidate (build 26A428) to developers ahead of the final public release.
Apple published a Release Candidate build of macOS 27.0, labeled 26A428, on its developer release page. The notice only provides download and release-notes links and includes no security content, CVEs, or threat information. RC builds typically precede the general availability of the final operating system version.
Apple seeded visionOS 27.0 beta 8 (build 24M5361a) to developers, continuing the Vision Pro pre-release testing cycle.
Apple released visionOS 27.0 beta 8, build 24M5361a, to its developer program on August 31, 2026. The listing offers only downloads and release notes with no disclosed security fixes or CVEs. This is the eighth beta in the visionOS 27.0 cycle ahead of the stable release.
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
CISA added actively exploited macOS flaw CVE-2026-65400 to its KEV catalog, affecting Tahoe, Sequoia, and Sonoma, with a patch deadline of August 21, 2026.
CISA acknowledged active exploitation of CVE-2026-65400, an authentication flaw affecting macOS Tahoe, Sequoia, and Sonoma, and added it to the Known Exploited Vulnerabilities Catalog. The vulnerability was discovered and reported to Apple by Alfredo Pesoli via Bynario Atlas. The remediation deadline is August 21, 2026.