Apple has released out-of-band security updates addressing multiple vulnerabilities, including four WebKit flaws discovered using AI tools, such as memory corruption and use-after-free issues that could cause crashes or arbitrary code execution. The CVSS scores for the listed CVEs are 6.5 (MEDIUM). Affected versions are Apple Safari, iPadOS, iPhone OS, and macOS versions prior to 26.5.2, with macOS specifically affected from version 26.0 up to but excluding 26.5.2. The fixed version for all listed platforms is 26.5.2.
Vulnerability Management Apple releases early security updates, citing AI-driven exploit acceleration July 1, 2026 Share By SC Staff (Credit: ink drop – stock.adobe.com) According to Security Affairs, Apple has released out-of-band security updates for iOS, iPadOS, macOS, and Safari, addressing nearly 30 vulnerabilities, including four in WebKit that were discovered using AI tools. The updates address critical flaws in WebKit, the rendering engine for Safari and other applications on Apple devices. Among the patched vulnerabilities are CVE-2026-43707 (memory corruption), CVE-2026-43716 (unexpected Safari crash), CVE-2026-43745 (out-of-bounds write), and CVE-2026-43715 (use-after-free). Additionally, fixes were issued for kernel-level bugs that could lead to kernel state leaks, system crashes, or memory corruption. Apple stated that none of the patched vulnerabilities showed signs of active exploitation prior to the release. This accelerated release schedule, deviating from Apple's typical practice of bundling fixes with major software versions, is a direct response to concerns that AI tools can rapidly accelerate the development of exploits from known vulnerabilities. The company aims to compress the time between vulnerability discovery and deployment to mitigate potential risks in an evolving cybersecurity landscape where AI is increasingly used by both defenders and attackers. Source: Security Affairs SC Staff Related Vulnerability Management Progress Kemp LoadMaster vulnerability actively exploited SC Staff July 1, 2026 The operating system command injection flaw, with a CVSS score of 9.6, enables unauthenticated attackers to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input. Vulnerability Management Critical Oracle E-Business Suite bug actively exploited Steve Zurier June 30, 2026 Critical Oracle EBS flaw now exploited, prompting urgent patching guidance. Vulnerability Management Anonymous researcher dumps zero-day exploits for multiple software products SC Staff June 30, 2026 The disclosed exploits include a critical pre-authentication remote code execution vulnerability in libssh2 (CVE-2026-55200) and an authentication bypass vulnerability in self-hosted Gitea Docker deployments (CVE-2026-20896), which allows attackers to impersonate users and take over Git servers. Related Events Cybercast Why Mythos is the cybersecurity crisis we need Wed Jul 22 Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds