- Apple has released iOS 26.6 with critical security updates, including fixes for CVE-2026-64735 and CVE-2026-64721.
- CVE-2026-64735 could allow a remote attacker to bypass network filters, while CVE-2026-64721 could see an app be able to access sensitive user data.
- Another serious issue fixed in iOS 26.6 is an integer overflow vulnerability in ImageIO tracked as CVE-2026-43818, where processing a maliciously crafted image may lead to arbitrary code execution.
- In iOS 26.6, Apple is patching weaknesses before they become a potential attack vector.
- Other iOS 26.6 fixes have patched some apps which were 'accessing data they shouldn’t.'
- These types of flaws are often used alongside other vulnerabilities in attacks utilizing spyware.
- CVE-2026-64757 is credited to 'Milad Nasr and Nicholas Carlini with Claude, Anthropic.'
- Card points out that the nature of the fixes themselves are more important in any patch cycle.
- In the case of iOS 26.6, that means updating as soon as possible.
- Users should ensure their phones have enough storage to update and that their devices are patching.
Apple has released iOS 26.6, which includes critical security updates addressing nearly 90 vulnerabilities, notably CVE-2026-64735 and CVE-2026-64721.123
The update is particularly significant as it fixes flaws in WebKit, the engine behind Safari, which could have serious implications for users.
CVE-2026-64735 poses a risk of allowing remote attackers to bypass network filters, while CVE-2026-64721 could enable unauthorized access to sensitive user data.
Additionally, the update addresses an integer overflow vulnerability in ImageIO, tracked as CVE-2026-43818, which could lead to arbitrary code execution when processing malicious images.4
Experts emphasize the importance of these fixes, noting that such vulnerabilities are often exploited in conjunction with other security flaws.
Although Apple has not confirmed any exploitation of these vulnerabilities, the proactive measures taken in iOS 26.6 are crucial for user security.
Users are advised to ensure their devices have sufficient storage for the update and to apply the patch as soon as possible, as it only takes a few minutes.
“Make sure your devices are patching — it only takes a few minutes,” said a security expert, highlighting the urgency of the update.
The release also sets the stage for upcoming Siri features expected in iOS 27.
“iOS 26.6 addresses significant vulnerabilities, such as CVE-2026-64735, which could allow remote attackers to bypass network filters, and CVE-2026-64721, which could expose sensitive user data. Users are advised to update promptly and ensure sufficient storage for the installation.”
Forbes
