Apple published 11 new security advisories covering dozens of vulnerabilities in macOS, iOS, iPadOS, watchOS, tvOS, and visionOS. iOS and iPadOS 26.5 address over 60 CVEs including 20 WebKit-related issues that can cause crashes, data leaks, and security bypasses. macOS Tahoe 26.5 and other macOS versions patch nearly 80 vulnerabilities that allow privilege escalation, sandbox escape, Gatekeeper bypass, arbitrary code execution, and information disclosure. A patch for a deleted chats recovery flaw, exploited by the FBI to recover Signal chats, was ported to older iOS versions. No other vulnerabilities are currently known to be exploited in the wild. The vendor has released official fixes for all these issues.

The vulnerabilities fixed include issues that could lead to denial of service, exposure of sensitive user data, privilege escalation to root, sandbox escapes, security bypasses including Gatekeeper, arbitrary code execution with elevated privileges, and user tracking. The deleted chats recovery flaw could allow recovery of supposedly deleted messages, impacting user privacy. While the FBI reportedly exploited this flaw, no other exploitation in the wild has been reported. The impact spans multiple Apple operating systems and affects core security mechanisms.

Apple has released official patches for all the vulnerabilities described, including backports to older iOS versions for the deleted chats recovery issue. Users and administrators should apply the latest updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS as soon as possible to remediate these vulnerabilities. Since official fixes are available, applying these updates is the primary recommended mitigation.