iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

macOS Golden Gate 27.2 resolves 263 vulnerabilities while iOS and iPadOS 27.2 fix 163 flaws, with approximately 140 security holes shared across both operating systems. The updates address numerous memory corruption bugs in WebKit, the kernel, and components handling images, fonts, PDFs, audio and video files, some of which could be exploited for arbitrary code execution.

Critical vulnerabilities fixed

Apple resolved flaws that could allow apps to access sensitive user data or bypass privacy preferences, along with WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give nearby attackers access to Thread networks. macOS patches also address more than a dozen privilege escalation flaws that could grant apps root access.

The updates fix security holes in Screen Sharing, Remote Management and SMB that can be targeted remotely or from local networks, including a Remote Management bug enabling remote arbitrary code execution.

Zero-day addressed

iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950, which had been exploited as a zero-day in what Apple described as an "extremely sophisticated attack." Discovered by Meta's product security team, this vulnerability was first patched in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.

Additional updates released

Apple also released iOS and iPadOS 26.7.2 (134 vulnerabilities), macOS Tahoe 26.7.2 (213 vulnerabilities), and macOS Sequoia 15.8.2 (197 vulnerabilities). Other updates include tvOS 27.2 (72 vulnerabilities), watchOS 27.2 (62 vulnerabilities), visionOS 27.2 (125 vulnerabilities), and Safari 27.2 (33 vulnerabilities).