Apple's Record-Breaking 194-CVE Security Update: iOS 26.6, macOS Tahoe 26.6

Security Fix Totals by Platform

The volume of fixes varies across Apple's operating systems:

• macOS Tahoe 26.6: Between 143 and 155 unique CVEs (Apple's official listing and third-party counts differ slightly) .
• iOS and iPadOS 26.6: 78 security fixes, tied to 87 unique CVE numbers .
• watchOS 26.6: 84 security fixes .
• tvOS 26.6: 84 security fixes .
• visionOS 26.6: 84 security fixes .

Apple also rolled out macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 for older Macs not running macOS Tahoe, both focused on the same security fixes .

Most Serious Vulnerabilities Fixed

Several critical vulnerabilities stand out in Apple's security advisories:

• MediaRemote: An app could gain root privileges via a parsing issue in directory path handling .
• AVEVideoEncoder (CVE-2026-64747): A buffer overflow that could let an app execute arbitrary code with kernel privileges .
• Game Center and libc: Sandbox escape vulnerabilities — a malicious app could break out of its sandbox .
• CloudAttestation (CVE-2026-43813): A maliciously crafted app could bypass code signing enforcement .
• ImageIO: Arbitrary code execution when processing a maliciously crafted image .
• SceneKit: Three vulnerabilities that could lead to arbitrary code execution when processing maliciously crafted files .
• Kernel: More than a dozen fixes covering kernel memory corruption, information disclosure, and unexpected system termination .
• WebKit: Multiple fixes addressing process memory exposure, interface spoofing, iframe sandboxing violations, and Safari crashes .

AI Tools Credited Alongside Human Researchers

Perhaps the most striking trend in this update is the prominent credit given to AI tools in Apple's security notes :

• Anthropic's Claude and Anthropic researchers are credited with fixes in WebKit, WebKit Storage, and WebDAV, some of which were made alongside the Calif.io research team .
• OpenAI Codex Security is credited with contributing to vulnerability discovery, continuing a pattern first seen in the earlier iOS 26.5.2 security update .
• Nvidia's AI Red Team is credited in the security notes for finding vulnerabilities .
• Z.AI's GLM model is also credited alongside human researchers in the acknowledgments .

This follows Apple's earlier disclosure that it accelerated its security update cadence in direct response to AI-powered hacking tools. The volume of fixes in this release — the largest single security update in Apple's history — is attributed in part to AI tools helping researchers find vulnerabilities faster .

Active Exploitation Status

Apple does not identify any of these vulnerabilities as having been actively exploited in the wild . This is consistent with the company's stated approach of releasing patches faster — even moving fixes originally planned for 26.6 into the earlier 26.5.2 update — in response to the increased speed of AI-assisted attackers .

Spotlight Optimization for iOS 27

Beyond security, macOS Tahoe 26.6, iOS 26.6, and iPadOS 26.6 include a significant under-the-hood change: an optimization of the Spotlight index specifically to prepare for the upcoming version 27 releases expected this fall . Apple rearchitected the search index at WWDC to be more stable, comprehensive, and responsive, and this update pre-optimizes the index to ensure a smoother upgrade experience when iOS 27, macOS 27, and iPadOS 27 arrive .

How to Update

All of Apple's 26.6 updates are available to users now. iPhone and iPad users can update via Settings > General > Software Update, while Mac users can use System Settings > Software Update. The watchOS and tvOS updates are available through their respective companion apps.

Given the record-breaking number of fixes and no active exploitation yet, security experts recommend updating promptly to close the window before attackers reverse-engineer the patches.