Apple released a record-size security wave on September 14, 2026, covering iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode. The new trains are iOS 27, iPadOS 27, and macOS Golden Gate 27; older devices get iOS 26.7, iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8. SANS counted 261 unique CVEs across those advisories; many of the same bugs appear on more than one product.

Serious fixes include a Bluetooth out-of-bounds write that can let a remote attacker run code, a video-encoder race that can give a sandboxed app kernel privileges, and a CoreMedia image bug that Apple removed instead of patching in place. Apple has not marked any of these issues as exploited in the wild. Install the update for your device now.

- https://support.apple.com/en-us/100100
- https://support.apple.com/en-us/149034
- https://support.apple.com/en-us/149035
- https://support.apple.com/en-us/149041
- https://isc.sans.edu/diary/33336