Overview
- Apple issued a coordinated set of updates on Monday and Tuesday that fixed 329 unique vulnerabilities and listed a combined 1,265 CVE entries across iOS, iPadOS, macOS, watchOS, tvOS, visionOS and Safari.
- The company backported a CoreGraphics out‑of‑bounds write tracked as CVE-2026-86950 to older branches including iOS 18 to close a zero-day Apple said may have been used in an extremely sophisticated targeted attack.
- India’s CERT-In on Wednesday published a high-severity advisory naming the affected OS versions and urging users and organizations to install the patches immediately.
- Many of the patches address flaws in WebKit and media components that process images, fonts, PDFs, audio and video, which attackers can exploit by getting users to open crafted web pages or files.
- Users should install the updates now via Settings or System Settings and high-risk users should also check devices for signs of compromise because older models may rely on legacy branches that only receive backported fixes.