Advisories
Apple Releases Annual OS Updates Addressing 261 Vulnerabilities
Apple has rolled out its annual ecosystem-wide operating system updates, patching a record 261 vulnerabilities across multiple platforms. SecOps teams and administrators should plan deployment while accounting for third-party software compatibility and known download reporting glitches.
What Happened
Apple has launched its annual suite of major operating system updates, accompanied by backported security fixes for older branches such as version 26 and macOS Sequoia 15. This release cycle patches a record 261 distinct vulnerabilities across the vendor's ecosystem. While Apple does not assign explicit CVSS severity ratings to individual flaws, none are currently flagged as actively exploited in the wild.
Notable Vulnerabilities
The extensive patch list addresses flaws spanning multiple core components and subsystems. Key entries include:
- CVE-2026-28899: A WebDAV vulnerability allowing applications to bypass Gatekeeper checks.
- CVE-2026-28935 & CVE-2026-28968: Kernel-level issues where local applications can cause system termination or kernel memory corruption.
- CVE-2026-20683: An Apple Account authentication flaw involving the Sign In With Apple flow.
- CVE-2026-28930: An issue permitting unauthorized access to protected user data via Spotlight.
Impact and Operational Risks
Administrators should anticipate deployment anomalies. Reports indicate potential interface confusion during the iOS upgrade process, where devices displaying an older version string in download menus may actually install the target major release. Additionally, endpoint agents and security-relevant utilities—such as Objective-See's BlockBlock (v2.5.2) and Little Snitch—require updates prior to upgrading macOS to maintain compatibility and stability.
What to Do
Review asset inventories to map out deployment rings for the new major releases and backported patches.
Verify that third-party security tooling, monitoring agents, and system extensions have been updated to support the latest OS versions before pushing upgrades.
Monitor internal deployment pipelines for reporting discrepancies during iOS and iPadOS rollouts.
Related vulnerabilities
Apple Unveils iPadOS 27.0 (24A437) – Latest Update Drops on September 14, 2026
Apple has released iPadOS 27.0, code‑named 24A437, to all supported iPads on September 14, 2026. The new OS brings a host of refinements, performance tweaks, and security updates, all detailed in the official release notes available through the Developer portal.
Read briefing
Microsoft's September 2026 Patch Tuesday: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
On Patch Tuesday, Microsoft pushed 972 security updates, including 113 critical flaws and two zero‑day vulnerabilities that were actively leveraged in the wild. The patches cover Windows, Office, and Azure services, addressing remote code execution, privilege escalation, and data exfiltration risks. Security teams must deploy the updates immediately, validate coverage, and monitor for any lingering exposure, especially in legacy or exposed environments.
Read briefing
Microsoft September 2026 Patch Tuesday: 964 CVEs, Including Two Zero-Day Exploits (CVE-2026-81963, CVE-2026-85880)
Microsoft released its largest Patch Tuesday to date, addressing 964 CVEs—104 critical and 860 important—including two zero‑day vulnerabilities exploited in the wild. Defenders must prioritize applying updates to affected components such as .NET, Active Directory services, Azure services, Office, and Windows kernel drivers, and verify system integrity.
Read briefing
Apple Unveils macOS 27.0 Release Candidate (26A428) – Early Access for Developers
Apple has released the macOS 27.0 RC (build 26A428) to the developer community. The candidate brings a host of OS‑wide updates—new kernel tweaks, refreshed Safari, updated SwiftUI tooling, and a bundle of security patches—while the full release notes are still being finalized. Developers can download the build from the Apple Developer portal to test app compatibility and prepare for the upcoming public beta and final release later in 2026.
Read briefing