Apple shipped iOS 26.6 and iPadOS 26.6 on July 27, and the security notes attached to the release are unusually long even by Apple’s standards. According to Apple’s official advisory, the update resolves 78 documented vulnerability entries tied to 87 unique CVE numbers — the CVE count runs higher because several entries fix more than one flaw. Apple does not report that any of the patched vulnerabilities were actively exploited in the wild, but the severity ceiling on several of them makes this an update-now release rather than a wait-for-the-point-release one.
The fixes that should get your attention
A handful of entries stand out from the list, as 9to5Mac’s breakdown of the advisory highlights. A MediaRemote flaw could let an app gain root privileges — the worst-case outcome for a local privilege-escalation bug. An AVEVideoEncoder vulnerability could allow an app to execute arbitrary code with kernel privileges, and separate bugs in Game Center and libc could let a malicious app escape its sandbox entirely. A CloudAttestation flaw could permit an app to bypass code-signing enforcement, undermining one of iOS’s core defenses against tampered binaries.
Two of the entries follow the classic malicious-file pattern that has powered real-world attack chains in the past: an ImageIO vulnerability could lead to arbitrary code execution when processing a maliciously crafted image, and three SceneKit vulnerabilities could do the same when processing crafted files. Because image parsing happens automatically across Messages, Safari and countless apps, ImageIO bugs are historically among the most attractive targets for zero-click exploitation — which is exactly why patching them before details circulate matters.
Rounding out the notable entries: an Accessibility issue could expose sensitive data through iPhone Mirroring to someone with physical access to the device, and a Contacts flaw could let an app add contacts without the user’s permission.
Kernel, WebKit and Wi-Fi
Beyond the headliners, Apple fixed more than a dozen kernel vulnerabilities in this release. The documented impacts include corrupting or writing to kernel memory, disclosing kernel memory contents, bypassing network filters, and causing unexpected system termination. Kernel-memory disclosure bugs rarely make headlines on their own, but they are the reconnaissance half of most modern exploit chains — attackers pair them with a write primitive to defeat address randomization.
WebKit, the engine behind Safari and every in-app browser on iOS, received a sizable batch of its own fixes. The patched flaws could expose process memory, reveal whether a user had visited a specific link, enable interface spoofing, violate iframe sandboxing rules, let an app read files outside its sandbox, or crash Safari outright. One additional Wi-Fi vulnerability could allow a nearby attacker to corrupt process memory — a reminder that the radio stack remains an attack surface that requires no user interaction at all.
After the 78 documented fixes, Apple’s advisory adds a separate “Additional recognition” section crediting 12 researchers and teams for assistance that didn’t rise to separately numbered CVEs. The full entry-by-entry list is on Apple’s security releases page, which also tracks the same-day advisories for Apple’s other platforms.
Not just iPhone — and some recent context
The July 27 release wave covers Apple’s whole lineup, with macOS 26.6 arriving alongside the iPhone and iPad updates. If you manage multiple Apple devices, the same update-promptly logic applies across all of them, since many of the underlying components — WebKit, ImageIO, the kernel — are shared code.
There’s also a timing thread worth noting. 9to5Mac reports that Apple previously said it accelerated a number of security fixes in last month’s iOS 26.5.2 release specifically because AI-powered hacking tools were speeding up vulnerability discovery. Seen against that backdrop, a 78-entry advisory in a mid-cycle point release looks less like an anomaly and more like the new operating tempo: larger patch batches, shipped faster, because the time between a bug existing and a bug being found keeps shrinking.
How to update
On iPhone or iPad, head to Settings → General → Software Update, and enable automatic updates if you’ve been putting it off. The update is available for all devices that run iOS 26. Given the presence of root-privilege escalation, sandbox-escape and crafted-image code-execution fixes in one advisory — even with no known in-the-wild exploitation — the practical advice is the boring kind: install it today, not this weekend.
