Apple fixes 329 unique security flaws in its latest updates

What happened

On Monday 26 October 2026 Apple released a wave of software updates and published the matching security details on its security releases page, according to 9to5Mac ^[1]. The updates cover iOS 27.2 and iPadOS 27.2, iOS and iPadOS 26.7.2, iOS and iPadOS 18.7.11, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2 ^[1]. A further tvOS 26.6.1 update for older Apple TV models has no published CVE entries ^[1].

9to5Mac counts 329 unique vulnerabilities fixed across the releases. Because many flaws affect more than one operating system, the combined total is 1,265 CVE listings ^[1]. The site notes the numbers may rise, since Apple regularly adds or revises entries after publication ^[1].

Notable fixes

According to 9to5Mac, the most notable fixes include ^[1]:

• A CoreMedia issue (CVE-2026-86990) that could let a malicious app access the camera on an iPhone, iPad, Mac or Apple Vision Pro without permission.
• An Apple Intelligence vulnerability (CVE-2026-86987) that could let a remote attacker reach sensitive user data on supported iPhones and iPads.
• A Siri vulnerability (CVE-2026-43736) in macOS Tahoe that could let an app access sensitive user data.
• Several WebKit flaws where maliciously crafted web content could execute arbitrary code.

The updates also bring an earlier CoreGraphics fix (CVE-2026-86950) to devices still on iOS 18 and iPadOS 18. A malicious file could trigger arbitrary code execution, and 9to5Mac says Apple first fixed it last month, warning that it may have been exploited in an extremely sophisticated attack against specific targeted individuals running versions of iOS before iOS 27 ^[1].

The role of AI

9to5Mac reports that Apple has been patching WebKit heavily in recent months, partly driven by growing use of AI tools to find vulnerabilities, and that Apple credited AI tools and research teams for several of the flaws fixed in these releases ^[1]. It also recalls that earlier this year Apple shipped fixes for flaws exploited by the Coruna and DarkSword exploit kits, both of which used WebKit vulnerabilities to compromise iPhones on older iOS versions ^[1].

What it means for you

The practical message is simple: install the updates. The list of supported devices is wide. The iOS 27.2 release covers iPhone 11 and later, while iOS 18.7.11 is for the iPhone XS, XS Max, XR and the seventh-generation iPad ^[1]. Older hardware is therefore still receiving fixes, which matters for businesses that keep devices in service for years.

For companies managing fleets of Macs and iPhones, the sheer volume is a reason to check that automatic updates or device-management policies are working, rather than leaving patches until a convenient moment. Staff who use older iOS 18 devices should not assume they are safe because they have not upgraded, given the CoreGraphics fix reached them in this round ^[1].

The scale of the release also shows how AI is changing security work on both sides. Tools that help researchers find flaws faster produce more fixes to apply, and organisations need a routine to absorb them. Apple's own security releases page carries the full detail for each update, and 9to5Mac links to each advisory ^[1].

Source: 9to5Mac — Apple addressed at least 329 unique security vulnerabilities across today's system updates