www.it-connect.fr
Apple Patches 200+ Flaws Across Its Platforms, Including 11 Found With AI
A simple ZIP archive was enough to bypass Gatekeeper. A booby-trapped app could execute code with kernel privileges. Seven distinct vulnerabilities led to root access on macOS. That gives you a quick overview of the 8 security bulletins released on July 27, 2026 by Apple, covering 210 vulnerabilities. Even though there are no zero-day flaws, these fixes are worth paying attention to.
Code Executed with Kernel Privileges
The most severe vulnerability is tracked as CVE-2026-64747. Located in the AVEVideoEncoder component, it allowed an application to execute arbitrary code with kernel privileges, the highest possible level of compromise on an Apple system. It affected every platform, from iPhone to Vision Pro and Mac. This is a buffer overflow, and its discovery is credited to Franco Belman of Blackwing Intelligence.
On macOS Tahoe, 7 vulnerabilities also have a significant impact because they provide root access:
- CVE-2026-39875 and CVE-2026-43698, both in CUPS, the printing system.
- CVE-2026-43693 in Core Services, a race condition.
- CVE-2026-43749 in Accounts, a directory path parsing issue.
- CVE-2026-43755 in SecurityAgent, also a race condition.
- CVE-2026-39874 in Remote Management.
- CVE-2026-43723 in MediaRemote, present on all Apple platforms.
The first item on this list is noteworthy for another reason. Apple credits its discovery to several researchers, and this also references AI: "Aaron Grattafiori - NVIDIA AI Red Team" and "XBreach.ai". In fact, AI is mentioned multiple times across Apple’s various security bulletins:
- Claude, from Anthropic: CVE-2026-64757 and CVE-2026-43715 in WebKit, as well as CVE-2026-64704 (
SMB) and CVE-2026-64703 (WebDAV), the latter two in collaboration with Calif.io. - Codex Security, from OpenAI: CVE-2026-43707 and CVE-2026-43745 in WebKit.
- NVIDIA’s AI Red Team: CVE-2026-43701 in WebKit and, most notably, CVE-2026-39875, one of the privilege escalations to root in CUPS.
- GLM, from Z.AI: CVE-2026-64783 and CVE-2026-43663 in WebKit.
- Atuin Automated Vulnerability Discovery Engine: CVE-2026-43760, in the screen sharing server.
A certain continuity at Apple following the thirty or so flaws fixed at the end of June, partly thanks to AI.
Four Gatekeeper Bypasses, Including Three via ZIP Archives
Apple has fixed four flaws that allowed attackers to bypass Gatekeeper, the mechanism that blocks unsigned or unnotarized apps downloaded from the Internet. Three of them rely on the same principle: a specially crafted ZIP archive prevented the quarantine attribute from being applied to extracted files. These three vulnerabilities affect macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8, while the latest version (Tahoe) is spared:
- CVE-2026-28849 in BOM.
- CVE-2026-28900 in libarchive.
- CVE-2026-28914 in the zip component.
The fourth, CVE-2026-64708, affects all three branches of macOS. It is located in DesktopServices and once again allowed the file quarantine mechanism to be bypassed.
That is not trivial, because booby-trapped archives are a classic delivery vector for malicious payloads, including on macOS. A file that should trigger a warning will run without a word if one of these flaws is exploited.
How to Protect Yourself
In total, Apple fixed just over 200 vulnerabilities across its entire ecosystem. That is a lot. All security patches have been available since July 27, 2026. Here is the summary with links:
- iOS and iPadOS 26.6: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, iPad mini 5th generation and later.
- macOS Tahoe 26.6: Macs running macOS Tahoe.
- macOS Sequoia 15.7.8: Macs running macOS Sequoia.
- macOS Sonoma 14.8.8: Macs running macOS Sonoma.
- tvOS 26.6: Apple TV HD and Apple TV 4K, all models.
- watchOS 26.6: Apple Watch Series 6 and later.
- visionOS 26.6: Apple Vision Pro, all models.
- Safari 26.6: browser for macOS Sonoma and macOS Sequoia.
