Apple on Monday released updates for its operating systems, addressing a total of 286 vulnerabilities across the newest versions of iOS and macOS. In addition, the company has backported the fix for an exploited vulnerability to iOS 18.
macOS Golden Gate 27.2 resolves 263 vulnerabilities while iOS and iPadOS 27.2 fix 163 flaws. Roughly 140 of the security holes are shared across the two operating systems.
The iOS and iPadOS 27.2 updates address many memory corruption bugs in WebKit, the kernel and components that handle images, fonts, PDFs, audio and video files, some of which could be exploited for arbitrary code execution.
Apple also resolved flaws that could let apps access sensitive user data or bypass privacy preferences, along with WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give a nearby attacker access to a Thread network.
macOS Golden Gate 27.2 patches more than a dozen privilege escalation flaws that could give apps root access, as well as sandbox escapes, Gatekeeper bypasses and kernel memory corruption issues in file system and disk image components.
The update also fixes numerous security holes in Screen Sharing, Remote Management and SMB that can be targeted remotely or from the local network, including a Remote Management bug that could allow a remote attacker to execute arbitrary code.
iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, which had been exploited as a zero-day in what Apple described as an “extremely sophisticated attack.”
The vulnerability, discovered by Meta’s product security team, was first patched by Apple in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. iOS and macOS 27 do not appear to be affected.
There does not appear to be any public information detailing the attacks exploiting CVE-2026-86950.
Apple on Monday also released iOS and iPadOS 26.7.2, which fix 134 vulnerabilities, macOS Tahoe 26.7.2, which patches 213 vulnerabilities, and macOS Sequoia 15.8.2, with 197 flaws patched.
The tech giant also released tvOS 27.2 (72 vulnerabilities patched), watchOS 27.2 (62 vulnerabilities), visionOS 27.2 (125 vulnerabilities), and Safari 27.2 (33 vulnerabilities).
Related: Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks
Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
Related: AI Slop Limits Apple Bounties
