A malicious app accessing your camera without permission or an attacker gaining access to sensitive information are among the security risks addressed in Apple’s latest software updates.
The updates fix 329 unique vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari.
It’s one of Apple’s largest security releases in recent memory, with fixes extending to older iPhones and iPads that cannot run the newest operating systems.
Because some vulnerabilities affect multiple platforms, the combined security advisories contain 1,265 CVE listings. That figure includes repeated entries for the same flaws across different products.
Camera access and personal data vulnerabilities patched
Two fixes are particularly important for privacy.
CVE-2026-86990, a vulnerability in CoreMedia, could allow a malicious app to access a device’s camera without permission. The flaw affects iPhone, iPad, Mac, and Apple Vision Pro.
Another issue, CVE-2026-86987, affects Apple Intelligence and could allow a remote attacker to access sensitive user information on supported iPhones and iPads.
Apple also addressed a Siri vulnerability in macOS that could expose sensitive data to an unauthorized app.
Several WebKit flaws were patched as well, including vulnerabilities that could allow malicious web content to execute code on a device. WebKit powers Safari and has previously been targeted by exploit kits such as Coruna and DarkSword.
The security advisories describe potential consequences of these flaws, not evidence that every vulnerability was exploited.
AI-assisted research contributed to the fixes
Apple’s security acknowledgments credit AI-assisted research tools alongside human researchers for identifying several vulnerabilities.
Tools such as Claude and Codex are increasingly being used to examine software for security weaknesses, helping researchers identify problems that might otherwise take longer to uncover.
Older iPhones and iPads receive security updates
The October 26 releases cover three generations of Apple’s mobile operating systems:
- iOS 27.2 and iPadOS 27.2: Current-generation devices.
- iOS 26.7.2 and iPadOS 26.7.2: Devices remaining on the previous software generation.
- iOS 18.7.11 and iPadOS 18.7.11: Older hardware, including the iPhone XS and seventh-generation iPad.
The iOS 18.7.11 update addresses a particularly serious CoreGraphics vulnerability, tracked as CVE-2026-86950, that could allow a malicious file to execute arbitrary code.
Apple previously patched the flaw for newer systems and warned that it may have been exploited in a highly targeted attack against individuals using older iOS versions.
The latest release extends that protection to additional devices still running iOS 18.
Given the number and severity of the vulnerabilities addressed, it’s advisable to install the appropriate update promptly, even if none of the new features interest you.
You can check for updates through Settings > General > Software Update on iPhone and iPad, or System Settings > General > Software Update on Mac.
Full details are available on Apple’s security releases page.
