Apple has released iOS 26.6, along with a long list of nearly 90 iPhone security fixes. One of the last iPhone upgrades before iOS 27 is launched this Fall, the iOS 26.6 update is light on features, but heavy on bug fixes. The iOS 26.6 update also paves the way for some of the Siri features due to launch in iOS 27.
Apple does not provide much detail about the security fixes issued in iOS 26.6, to give iPhone users as much time as possible to update before attackers can get hold of the details.
But experts say the flaws iOS 26.6 fixes in WebKit, the engine that underpins Apple’s Safari browser, could have the greatest impact on iPhone users. Daniel Card, a cybersecurity consultant at Xservus Limited, highlights the browser based WebKit issues, which he says are more likely to be leveraged by attackers.
For example, iOS 26.6 addresses CVE-2026-64730, which could allow an attacker to perform UI spoofing, if you visit a website that frames malicious content, according to the iPhone maker’s support page.
Other Bugs Squashed In iOS 26.6
Apple’s iOS 26.6 also patches multiple issues in the Kernel, at the heart of the iOS operating system,. One of the most concerning is CVE-2026-64735, which could allow a remote attacker to bypass network filters. Meanwhile, CVE-2026-64721 could see an app be able to access sensitive user data.
Another serious issue fixed in iOS 26.6 is an integer overflow vulnerability in ImageIO tracked as CVE-2026-43818, where processing a maliciously crafted image may lead to arbitrary code execution. These types of flaws are often used alongside other vulnerabilities in attacks utilising spyware.
“We tend to think of photos as harmless, but in fact a phone has to process every image it receives,” says Jake Moore, global cybersecurity advisor at ESET.
Although unlikely, if there happens to be a flaw in the way the phone processes a picture, it could “become the attack,” says Moore. “Although Apple hasn’t said any of these ImageIO flaws have actually been exploited, in iOS 26.6 they are rightly patching weaknesses before they become a potential attack vector — which is exactly what you want from a security update.”
Other iOS 26.6 fixes have patched some apps which were “accessing data they shouldn’t,” says Moore. “Most people think of cyberattacks as malware, whereas actually it is often permission abuse by seemingly harmless apps.”
Interestingly, Anthropic’s Claude, an AI agent, is credited with finding one of the flaws. CVE-2026-64757 is credited to “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”
Apple’s iOS 26.6 comes nearly a month after the iOS 26.5.2 update, a security only upgrade that represented a shift in Apple’s patch cycle as AI helps researchers find bugs more quickly and at scale.
iOS 26.6—Update Now To Keep Your iPhone Safe
While iOS 26.6 contains a large number of updates, Card points out that the nature of the fixes themselves are more important in any patch cycle. “The WebKit bugs are the reason users should care, as they can be leveraged by phishing kits for example,” he says.
In the case of iOS 26.6, that means updating as soon as possible. “I’d say two things to people: Make sure your phones have enough storage to update. Make sure your devices are patching — it only takes a few minutes.”
You know what to do. Go to Settings > General > Software Update and upgrade now to iOS 26.6 to keep your iPhone safe.
