iOS 26.4 and Co.: Security improvements in the updates

With the updates to iOS 26.4, macOS 26.4, iPadOS 26.4, watchOS 26.4, visionOS 26.4, tvOS 26.4 released on Tuesday evening, along with new firmware for the HomePods, Apple is once again delivering a large package of security fixes. These should be taken seriously: Recently, there have been serious attacks on older iOS versions, and a known exploit kit has been made available in source code. The incidents show that Apple needs to react faster – and users urgently need to stay up to date. While Apple has introduced new features like the so-called Background Security Improvements, which promise faster updates (with shorter reboot times), it rarely uses them or hides them in the system settings.

What's in the updates from a security perspective

As usual, only the latest operating systems receive all fixes from Apple – this is also repeatedly criticized. The updates to iOS 26.4 and iPadOS 26.4 as well as macOS Tahoe 26.4 deliver dozens of bug fixes, including those that can be exploited remotely. On the iPhone, the baseband can be disabled (Denial of Service) in the 16e, and on other devices, apps can be crashed this way. The same applies to the Calling Framework, which is now also available for macOS.

The clipboard can leak data, an iCloud trick can be used to read which apps are installed, and there are several bugs in the kernel that could be used for deeper hacking attempts. At least Apple does not report any direct reports of known attacks on the now-fixed security vulnerabilities. Apple does not detail over 40 holes patched in the new systems – this is also repeatedly criticized. What exactly is vulnerable is often only communicated months later.

Other operating systems and older versions

visionOS 26.4, watchOS 26.4 and tvOS 26.4 also contain many security fixes with system-adapted changes. Safari 26.4 is delivered individually with bug fixes for various WebKit vulnerabilities. It is available for macOS Sonoma (14) and Sequoia (15), otherwise it is part of macOS 26.4. The development environment Xcode also contained security-relevant bugs and should be updated to Xcode 26.4.

Apple also continues to provide macOS 15.7.5, macOS 14.8.5 and iOS and iPadOS 18.7.7 for download, which fix some bugs for older operating systems as well. As mentioned, you are only fully protected if you update to version 26.4 of the respective operating systems.

(bsc)