The Center for Internet Security warns that multiple security flaws in Apple's operating systems and Safari browser could let attackers take over affected devices, with one flaw already seen in real-world attacks.
Apple has released software updates to fix a batch of security flaws affecting iPhones, iPads, Mac computers, Apple Watch, Apple TV, Apple Vision Pro, and the Safari web browser, according to the Center for Internet Security.
The most serious of these flaws could let an attacker run malicious code on a device, sometimes with the highest level of system access. In practice, that could allow someone to install unwanted programs, steal or alter data, or take broader control of the device.
One of the vulnerabilities, tracked as CVE-2026-86950, may already have been used in attacks, according to Apple. The Cybersecurity and Infrastructure Security Agency added that flaw to its list of known exploited vulnerabilities on September 29, 2026.
The flaws affect iOS and iPadOS versions before 27.2, 26.7.2, and 18.7.11; several macOS versions; tvOS, watchOS, and visionOS before 27.2; and Safari before 27.2 on certain Mac systems. The Center for Internet Security rates the risk as high for government agencies and businesses of all sizes, and low for typical home users.
Many of the flaws involve how these systems process files, images, or web content, meaning simply opening a malicious file or visiting a compromised webpage could trigger an attack. Others could let an app or attacker gain elevated system privileges once a device is already compromised.
The Center for Internet Security recommends installing Apple’s updates as soon as possible after testing, with priority given to devices still running older iOS or iPadOS 18 versions and to devices used by people at higher risk of being targeted. The agency also advises against visiting unfamiliar websites or opening files and links from unknown senders, since that remains a common way these kinds of flaws get exploited.
Based on a release from Center for Internet Security.