iOS 26.6—Apple Just Gave iPhone Users 90 Reasons To Update Now

Other Bugs Squashed In iOS 26.6

Apple’s iOS 26.6 also patches multiple issues in the Kernel, at the heart of the iOS operating system. One of the most concerning is CVE-2026-64735, which could allow a remote attacker to bypass network filters. Meanwhile, CVE-2026-64721 could see an app be able to access sensitive user data.

Of the iOS 26.6 patches, 19 sit in the kernel, but most still require an attacker to already have code running on the device, says Adam Boynton, senior enterprise strategy manager at cybersecurity outfit Jamf.

However, he says CVE-2026-43810 deserves a “second look.”

“Apple notes a remote user may be able to corrupt kernel memory, because remote changes the economics of an attack chain considerably,” Boynton explains.

Beyond phishing, the iOS 26.6 WebKit fixes could help protect users from sophisticated attacks using spyware, according to Boynton. “The raw material for targeted spyware is browser engine memory corruption and those chains are expensive enough that they get pointed at specific people like senior executives, journalists — anyone whose access justifies the cost.”

Another serious issue fixed in iOS 26.6 is an integer overflow vulnerability in ImageIO tracked as CVE-2026-43818, where processing a maliciously crafted image may lead to arbitrary code execution. These types of flaws are often used alongside other vulnerabilities in attacks utilising spyware.

“We tend to think of photos as harmless, but in fact a phone has to process every image it receives,” says Jake Moore, global cybersecurity advisor at ESET.

Although unlikely, if there happens to be a flaw in the way the phone processes a picture, it could “become the attack,” says Moore. “Although Apple hasn’t said any of these ImageIO flaws have actually been exploited, in iOS 26.6 they are rightly patching weaknesses before they become a potential attack vector — which is exactly what you want from a security update.”

Other iOS 26.6 fixes have patched some apps which were “accessing data they shouldn’t,” says Moore. “Most people think of cyberattacks as malware, whereas actually it is often permission abuse by seemingly harmless apps.”

Interestingly, Anthropic’s Claude, an AI agent, is credited with finding one of the flaws. CVE-2026-64757 is credited to “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”

Apple’s iOS 26.6 comes nearly a month after the iOS 26.5.2 update, a security only upgrade that represented a shift in Apple’s patch cycle as AI helps researchers find bugs more quickly and at scale.

Apple’s iOS 26.6 and iPadOS 26.6 are available for the iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later and iPad mini 5th generation and later.

iOS 26.6 Battery Drain Fix

Initial reports of bug fixes in iOS 26.6 are positive, with Reddit users saying the update has fixed battery drain issues they struggled with in iOS 26.5.2. According to one user, the new iPhone update has “fixed all the battery and heat problems I had on 26.5.2.”

Another commenter agrees: “The difference between 26.5.2 and 26.6 is massive. Before my 17 pro was mad hot to the touch, like constantly warm and sometimes so hot to be unconformable to held. Now it’s completely normal, most of the time is cold to the touch.”

The update appears to benefit iPads particularly. “It’s been working really well on my 13 Mini so far,” one user says. “The whole system seems to run more smoothly somehow, the battery lasts longer, and all the transparent icons are there right away and display correctly. Before, some of them would still reload when you returned to the home screen from an app.”

Yet be warned, it’s not the case for every single person or device. “Not true for me. Battery problems are awful still,” according to another user.

iOS 26.6 Features

The iOS 26.6 upgrade is light on features, with an update to Blocked Contacts in the form of an alert when you have blocked too many contacts. The iOS 26.6 betas had suggested a new iPhone anti-snatching feature was coming, but it doesn’t seem to be part of the final update and is now expected in a future version.

Apple also says the iOS 26.6 update “optimises the Spotlight index to prepare for iOS 27.” So what does this mean?

The groundwork in iOS 26.6 is to pave the way for Siri AI in iOS 27, which will rely on indexing your iPhone — a process that will happen in the background without affecting your experience.

The iOS 26.6 updates will make this process faster and seamless, so you don’t experience any negative impact when you update to iOS 27. That’s the theory, anyway.

Other Updates Issued Alongside iOS 26.6

Alongside iOS 26.6, Apple has issued macOS Tahoe 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 for Macs. Meanwhile tvOS 26.6 is available for the Apple TV HD and Apple TV 4K, as well as watchOS 26.6 for the Apple Watch Series 6 and later, visionOS 26.6 for the Apple Vision Pro, and Safari 26.6 for the macOS Sonoma and macOS Sequoia.

The updates issued alongside iOS 26.6 include some of the same fixes, while the Mac patch list is particularly long, with around 100 CVE numbers listed.

No iOS 18 Update Released Alongside iOS 26.6

Interestingly, there is no iOS 18 security update for older devices. This could be because iOS 26 is about to become the older version of iOS when iOS 27 comes out. Maybe the iOS 26.6 fixes don’t impact older iPhones. Or perhaps Apple is planning to release an update for older devices in a few days’ time.

But also note that there has not been an iOS 18 update since May when Apple issued iOS 26.5, despite the iPhone maker issuing both iOS 26.5.2 with a long list of patches, and iOS 26.6.

Apple does prioritise the security of its latest operating system and with iOS 26.6, it shows how it is doing just that while also paving the way for iOS 27.

iOS 26.6—Update Now To Keep Your iPhone Safe

While iOS 26.6 contains a large number of updates, Card points out that the nature of the fixes themselves are more important in any patch cycle. “The WebKit bugs are the reason users should care, as they can be leveraged by phishing kits for example,” he says.

In the case of iOS 26.6, that means updating as soon as possible. “I’d say two things to people: Make sure your phones have enough storage to update. Make sure your devices are patching — it only takes a few minutes.”

Boynton thinks the iOS 26.6 WebKit fixes, which could allow spyware to target iPhone users, are “the honest reason to update promptly, rather than eventually.”

While spyware targets certain subsets of iPhone users, once the details of patches are out there, the malware can be used more widely, according to Boynton. “Most people will never be a target worth that kind of investment. But once a vulnerability is patched and documented it stops being expensive, and it filters down to attackers who could never have afforded it in the first place.”

You know what to do. Go to Settings > General > Software Update and upgrade now to iOS 26.6 to keep your iPhone safe.