.png "Apple iOS 26.6.1 Security Update Release")
Apple released iOS 26.6.1, iPadOS 26.6.1, visionOS 26.6.1, and macOS Tahoe 26.6.2 on 17 August 2026. The coordinated set of updates patches 29 documented security vulnerabilities across the iPhone, iPad, Mac, and Vision Pro. The release arrives roughly three weeks after iOS 26.6 and ten days after Apple issued an emergency macOS fix for a critical screen-sharing flaw.
According to Apple's security bulletin, the largest group of fixes targets WebKit, the browser engine that underpins Safari and a large amount of web content handling on iPhone and iPad. The list also includes three kernel vulnerabilities, two image-processing bugs, a graphics-driver memory issue, an audio information leak, and an iPhone-only Telephony flaw that could allow a network attacker to bypass IPSec authentication.
Confirmed fact: Apple has not reported any of the 29 issues as actively exploited at the time of publication. There is currently no Apple-confirmed evidence that the release responds to a known in-the-wild zero-day.
Even so, the breadth of the patch list and the speed with which it follows iOS 26.6 make it an update most users should install promptly.
Here is what is fixed, who is affected, and why the release is notable.
At a Glance
- Released by Apple: Monday, 17 August 2026.
- Updates shipped: iOS 26.6.1, iPadOS 26.6.1, visionOS 26.6.1, macOS Tahoe 26.6.2, plus iOS 18.7.10 and iPadOS 18.7.10 for older devices.
- Security issues in Apple's bulletin: 29 affecting iOS 26.6.1, including one iPhone-specific Telephony issue.
- Largest component: 21 of the 29 entries affect WebKit, WebKit History, or WebKit Storage.
- Most serious bug listed: An ImageIO integer overflow (CVE-2026-65346) that, according to Apple, could lead to arbitrary code execution when processing a maliciously crafted image.
- iPhone-only fix: A Telephony flaw that could allow an attacker in a privileged network position to bypass IPSec authentication and intercept traffic.
- Known active exploitation: None reported by Apple as of publication.
- Build numbers: iOS and iPadOS 26.6.1 are build 23G83; macOS 26.6.2 is build 25G83.
Why This Matters
Security updates can feel routine. This one deserves attention for three reasons.
First, 21 of the 29 fixes are in WebKit, and WebKit is one of the most exposed pieces of code on Apple platforms. It underpins Safari and a large amount of web content handling across iPhone and iPad, including in-app browsers, email previews, and content loaded by messaging and social apps. A single malformed webpage can therefore reach a large portion of the code that runs on an iPhone, even when the user is not actively browsing.
Second, one of the ImageIO bugs (CVE-2026-65346) is listed by Apple as potentially leading to arbitrary code execution. Image processing can occur when images are received, previewed, or otherwise handled by apps, which makes this class of vulnerability worth taking seriously.
Third, the iPhone-only Telephony fix is relevant to VPN users. The flaw could allow an attacker in a privileged network position to bypass IPSec authentication and intercept traffic. IPSec is the protocol many VPNs use, so the issue is particularly relevant to enterprise-managed iPhones and to anyone who routinely connects to IPSec-based VPNs.
There is no evidence that any of these flaws are being used against real users. But once Apple publishes the CVE details, attackers study them to target devices that have not yet updated.
What iOS 26.6.1 Actually Fixes
The full list is long, but the vulnerabilities cluster into a small number of categories. The descriptions below summarize Apple's official impact statements.
WebKit (21 CVE entries)
This is the dominant group. Reported impacts include:
- Maliciously crafted web content causing an unexpected Safari crash
- Memory corruption in WebKit and WebKit Storage
- Out-of-bounds access, addressed through improved bounds checking
- Use-after-free errors
- A WebKit History issue that could allow a malicious website to leak sensitive data
- State-management failures and unexpected process termination
ImageIO (2 CVE entries)
Two image-processing flaws were fixed:
- CVE-2026-65346 (integer overflow): processing a maliciously crafted image could lead to arbitrary code execution, according to Apple's notes. Addressed with improved input validation.
- CVE-2026-65347: processing an image could lead to a denial-of-service condition.
These are the most practically serious entries in the bulletin because images are routinely processed across Messages, Mail, social apps, shared documents, and web content.
Kernel (3 CVE entries)
The kernel is the core of the operating system and controls access to memory, hardware, and protected resources. Apple lists three issues that could allow:
- A remote attacker to cause unexpected system termination
- An app to read kernel memory
- An app to corrupt kernel memory or terminate the system
Flaws that let an app read or modify kernel memory are treated seriously because they can be used as part of a privilege-escalation chain.
IOGPUFamily (1 CVE entry)
A memory issue in the graphics subsystem could allow malicious web content to cause memory corruption, according to Apple's notes. This is another example of web-facing content reaching deeper system code.
Audio (1 CVE entry)
A logic issue could allow an app to leak sensitive user information. It was addressed with improved checks.
Telephony, iPhone only (1 CVE entry)
The iPhone-only entry is the most network-relevant fix. According to Apple, an attacker in a privileged network position could bypass IPSec authentication and intercept traffic. This fix applies to iPhone only; it is not listed for iPad or Mac.
How the Vulnerabilities Break Down
| Component | Number of CVEs | Reported Impact (per Apple) |
|---|---|---|
| WebKit (including History & Storage) | 21 | Safari crashes, memory corruption, sensitive data leak |
| Kernel | 3 | System termination, kernel memory read or corruption |
| ImageIO | 2 | Arbitrary code execution (CVE-2026-65346), denial of service |
| IOGPUFamily | 1 | Memory corruption from malicious web content |
| Audio | 1 | Sensitive user information leak |
| Telephony (iPhone only) | 1 | IPSec authentication bypass, traffic interception |
| Total listed for iOS 26.6.1 | 29 | Includes one iPhone-specific entry |
The WebKit dominance is consistent with Apple's recent security bulletins. The browser engine is the most internet-exposed part of a modern iPhone because it processes untrusted web input every day.
Source note: The component counts in this table are based on Apple's official security support document for iOS 26.6.1 and iPadOS 26.6.1, as reported independently by MacRumors, AppleMagazine, and MacTrast. The exact grouping of CVEs may differ slightly between platforms.
Where the Fixes Came From
One unusual detail stands out in Apple's acknowledgments. Nine of the WebKit CVEs are credited to OpenAI Codex Security, OpenAI's AI-assisted vulnerability discovery system. One of those entries additionally credits researcher Amy Burnett. Other findings came from independent researchers and teams including Out of Bounds and Braze Security.
This is not the first time Apple has credited automated or AI-assisted tools. Even so, the concentration of Codex Security credits in a single release is notable because it shows how AI-assisted vulnerability discovery is increasingly appearing in mainstream software security research.
Apple also confirmed that the security fixes in iOS 26.6.1 were first made available in the iOS 27, iPadOS 27, and macOS Golden Gate 27 betas, then backported to the current public releases. That matters because most iPhone users are not running the beta. Backporting the fixes means they do not have to wait for September's annual upgrade to receive protection.
Apple's Recent Security Release Cadence
iOS 26.6.1 is the third notable Apple security release in about three weeks.
| Date | Update | Notable Fix (per Apple) | Devices |
|---|---|---|---|
| Late July 2026 | iOS 26.6 / iPadOS 26.6 / macOS 26.6 | Almost 90 security issues across App Store, Neural Engine, Wi-Fi, Siri, kernel, WebKit | iPhone, iPad, Mac |
| 7 August 2026 | macOS 26.6.1 | Critical screen-sharing vulnerability | Mac |
| 17 August 2026 | iOS 26.6.1, iPadOS 26.6.1, macOS 26.6.2, visionOS 26.6.1, iOS 18.7.10 | 29 CVEs including WebKit, kernel, ImageIO, IPSec | iPhone, iPad, Mac, Vision Pro, older devices |
The compressed schedule is partly structural. iOS 27 and macOS Golden Gate 27 are in beta, and testing for those releases is uncovering issues that also exist in the current operating systems. Apple has chosen to ship fixes to current users rather than making them wait for the annual update.
It is also a reminder that "point release" does not mean "small release." The version number 26.6.1 suggests a minor update, but the CVE count and the presence of a code-execution bug make it a meaningful security release.
Which Devices Are Supported?
The updates cover a wide range of hardware. Apple also issued iOS 18.7.10 and iPadOS 18.7.10 for devices that cannot run iOS 26.
| Platform | Version | Supported Devices |
|---|---|---|
| iPhone | iOS 26.6.1 | iPhone 11 and later |
| iPad | iPadOS 26.6.1 | 12.9-inch iPad Pro 3rd gen and later, 11-inch iPad Pro 1st gen and later, iPad Air 3rd gen and later, iPad 8th gen and later, iPad mini 5th gen and later |
| Mac | macOS Tahoe 26.6.2 | All Macs compatible with macOS Tahoe |
| Vision Pro | visionOS 26.6.1 | All Vision Pro models (detailed notes pending) |
| Older iPhone & iPad | iOS 18.7.10 / iPadOS 18.7.10 | Devices unable to run iOS 26 or iPadOS 26 |
The existence of iOS 18.7.10 alongside iOS 26.6.1 is worth noting. It means Apple is continuing to patch the previous major release for devices that did not qualify for iOS 26, rather than leaving those users without security coverage.
What Changes for Users
For most people, the practical guidance is straightforward.
Update when convenient. There is no Apple-confirmed active exploitation, but the vulnerabilities are now public and the fix is small. PCMag reports the iPhone update is roughly 500 MB when upgrading from iOS 26.6, so it should download and install quickly on a normal Wi-Fi connection. The Mac updater is typically larger.
If you use an IPSec-based VPN on your iPhone, this fix deserves particular attention. The Telephony patch closes a network-level interception path. That makes the issue particularly relevant to enterprise-managed iPhones.
Be cautious with images from unknown senders until you have updated. The ImageIO code-execution bug is triggered when an image is processed, which can happen during preview or receipt in apps. This is standard advice, but it applies with slightly more force this week.
"No known exploitation" is not the same as "no risk." Once Apple publishes CVE details, attackers compare patched and unpatched code to build exploits. Unpatched devices generally become easier targets over time, not harder.
What Happens Next
Apple is expected to continue the iOS 27 and macOS Golden Gate 27 beta cycle through late August and early September, with stable releases likely alongside new iPhone hardware in September. The fixes in iOS 26.6.1 will ship as part of those annual updates, but they are already available to current users.
Based on the current cadence, additional point releases before iOS 27 ships would not be surprising, particularly if beta testing surfaces more issues shared with the current operating systems. That expectation is based on the recent release pattern, not on any confirmed Apple roadmap.
We will update this article if Apple revises the bulletin, adds details to the visionOS entry, or confirms any in-the-wild exploitation.
FAQ
Should I install iOS 26.6.1 immediately?
Yes, if your iPhone is running iOS 26. There is no Apple-confirmed active exploitation, but the update fixes 29 documented security issues, including a code-execution vulnerability in ImageIO and an IPSec bypass on iPhone. The download is around 500 MB from iOS 26.6, according to PCMag, and Apple has not flagged major regressions.
Are any of these vulnerabilities known zero-days?
Apple has not reported any of the 29 vulnerabilities as actively exploited at the time of publication. That means there is currently no Apple-confirmed evidence that this release responds to a known in-the-wild zero-day. The assessment can change if Apple updates its bulletin, and this article will be revised if that happens.
What is the most serious fix in the release?
CVE-2026-65346, an integer overflow in ImageIO, is the most significant based on Apple's impact statement. Processing a maliciously crafted image could lead to arbitrary code execution. Images are processed across Messages, Mail, social apps, shared documents, and web content, so the attack surface is broad.
Do I need to update if I use a VPN?
If you use an IPSec-based VPN on an iPhone, yes. iOS 26.6.1 fixes a Telephony flaw that, according to Apple, could allow a network attacker to bypass IPSec authentication and intercept traffic. This issue affects iPhone only, not iPad or Mac.
What about older iPhones that cannot run iOS 26?
Apple also released iOS 18.7.10 and iPadOS 18.7.10 with security fixes for devices that cannot run iOS 26. If you are on an older device, install that update instead.
The Bottom Line
iOS 26.6.1 looks like a minor point release. In security terms, it is larger than the version number suggests.
The update closes 29 documented vulnerabilities across WebKit, the kernel, image processing, graphics, audio, and telephony. The WebKit fixes dominate the list, but the ImageIO code-execution bug and the iPhone-only IPSec bypass are the entries most users should care about. There is no evidence any of these flaws have been used against real people, but the details are now public, which means unpatched devices become more exposed with each passing day.
Install the update. If you run an IPSec-based VPN on your iPhone, install it sooner rather than later.
Sources: ++PCMag, "Apple Rolls Out iOS 26.6.1 With Fixes for 29 Security Issues," 19 August 2026++. Apple's official ++security releases++ page for iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 (17 August 2026). Independent reporting from ++MacRumors++, ++AppleMagazine++, ++MacTrast++, ++Thurrott++, and ++Zeera Wireless++. CVE identifiers and impact descriptions are drawn from Apple's security support document.
EDITORIAL NOTE - CONFIDENCE & SOURCE RELIABILITY
- The release of iOS 26.6.1, iPadOS 26.6.1, visionOS 26.6.1, and macOS 26.6.2 on 17 August 2026 is confirmed by Apple's official security support document (Tier 1 primary source) and independently reported by multiple specialist publications.
- The count of 29 security issues listed for iOS 26.6.1, including one iPhone-specific Telephony issue, is taken directly from Apple's bulletin. Component-level breakdown (21 WebKit, 3 kernel, 2 ImageIO, 1 IOGPUFamily, 1 Audio, 1 Telephony) is based on that document and corroborated by MacRumors, AppleMagazine, and MacTrast. Readers should consult Apple's official document for the definitive and current CVE list.
- CVE-2026-65346 (ImageIO arbitrary code execution) and CVE-2026-65347 (ImageIO denial of service) are identified in third-party reporting citing Apple's notes.
- The 500 MB update size is reported by PCMag from hands-on experience and may vary by device and source version.
- The statement that none of the vulnerabilities are known to have been actively exploited reflects Apple's bulletin as reported by MacRumors and other outlets. This is a point-in-time assessment and can change; the article will be updated if Apple revises its bulletin.
- The nine OpenAI Codex Security credits are reported by MacRumors and Michael Tsai based on Apple's acknowledgment section.
- Interpretation vs. fact: Statements describing why WebKit, ImageIO, and IPSec matter to users are PetaTech24 editorial explanation grounded in Apple's documented impact statements. Expectations about additional point releases and iOS 27 timing are clearly framed as forward-looking analysis based on release patterns, not confirmed Apple plans.
- No screenshots, proof-of-concept code, attacker attribution, or exploitation claims have been invented.
.png)
.png)
.png)
.png)
.png&description=iOS 26.6.1 Released: Apple Fixes 29 Vulnerabilities in WebKit, Kernel, IPSec){kind=link}
0 Comments