Security updates again: iOS 26.6.1, macOS 26.6.2 and more released
Small update, many vulnerabilities: Apple has patched around 30 security holes in a total of six operating systems. AI likely helped.
Update process on an iPhone: Problematic vulnerabilities again.
(Image: nikkimeel / Shutterstock.com)
Apple on Tuesday night released fresh security updates for its main operating systems again. The updates follow iOS 26.6 & Co. and the – equipped with only one fix – macOS 26.6.1, which were released at the end of July and just the week before last, respectively. At least a good 30 holes were patched per operating system again, with Apple not documenting its fixes and only publishing problems reported by external security researchers.
AI bug finding by OpenAI: remote system shutdown
iOS 26.6.1 and iPadOS 26.6.1 fix issues in the audio routine (sensitive data leak), ImageIO (Denial of Service, code execution), IOGPUFamily (memory corruption), the kernel (including a remotely exploitable “System Termination”), the telephony module (eavesdropping on data traffic even with IPSec encryption), and various WebKit bugs including history (visiting a malicious website could leak it). Furthermore, unspecified issues in compression, libcryptex, and WebKit were fixed. Again, a lot of artificial intelligence was used in finding the issues: several of the WebKit bugs have direct credits from OpenAI Codex Security.
Videos by heise
macOS 26.6.2 fixes most of the vulnerabilities in the iOS and iPadOS updates. The remote kernel bug that allowed the system to be shut down is also included here. visionOS 26.6.1 is also available for download; Apple has not yet named any security-relevant errors here, but they are likely to be similar to those in the iOS, iPadOS, and macOS updates. Finally, Apple is also providing iOS and iPadOS 18.7.10 for users who cannot (or do not want to) update to iOS and iPadOS 26. It contains older fixes that were already updated in the other systems; those still using the old systems should update urgently.
Sequoia and Sonoma missing – fear of quick exploits
What Apple has not provided are updates for macOS 15 (Sequoia) and macOS 14 (Sonoma). These should have been released along with the Tahoe updates – plus a new Safari version that fixes the WebKit vulnerabilities. The company has not yet provided any information on when these updates will be released.
The rapid pace of “out of band” updates for Apple's systems is due to the massive drop in bug reports thanks to AI, where Apple has pulled the emergency brake and limited the number of submissions. Often errors are reported multiple times here. A major problem from the perspective of security researchers is also that the submission of bug fix packages helps to quickly generate exploits: the versions are compared with each other and the exploitation is then developed using AI. For the aforementioned screen sharing vulnerability, an exploit is said to have been created within four hours.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(bsc)
