Apple Patches 108 Flaws in iOS, iPadOS and macOS 26

Apple dropped security updates today for iOS 26, iPadOS 26, iOS 18, iPadOS 18, and macOS 26, closing 108 vulnerabilities across the full platform. The SANS Internet Storm Center flagged the release Monday evening; the full CVE inventory will publish to Apple’s security advisories page in the hours following the drop.

This is the large cycle update — not a targeted hotfix. About two weeks ago Apple pushed a smaller standalone macOS-only patch addressing the macOS screen-sharing authentication bypass that had been confirmed exploited in the wild. That fix did not touch iOS or iPadOS. Today’s release covers mobile and desktop simultaneously.

What Updated

• iOS 26 and iPadOS 26 — current-generation releases
• iOS 18 and iPadOS 18 — supported prior-generation releases
• macOS 26 — current desktop release

Apple hasn’t published the full breakdown of affected subsystems or individual severity ratings yet. Once the advisory populates, look for remote code execution, kernel-level, or WebKit entries first — those are the ones that matter in managed-fleet prioritization decisions.

What to Do

Update now.

• iPhones and iPads: Settings → General → Software Update
• Macs: System Settings → General → Software Update

MDM-managed fleets should push the update immediately through enrollment profiles. If your organization runs a testing cycle before deployment, compress it. A 108-CVE patch envelope is too wide a surface to hold on a standard one-week delay.

Full CVE details are pending Apple’s advisory publication at support.apple.com/en-us/HT201222.