Apple Rushes Security Updates Early as AI-Powered Hacking Compresses Patch Windows

Apple rushed to squash 29 bugs because AI is supercharging hackers - update ASAP

Follow ZDNET: Add us as a preferred source on Google. ZDNET's key takeaways * Apple's latest OS updates patch 29 security flaws. * The fixes were rolled out sooner than expected. * Apple cited the increase in AI-powered security threats. iPhone, iPad, and Mac owners, it's time for another update. As usual, this one is designed to resolve a number of security vulnerabilities. And though none have yet been exploited by attackers, you'll still want to update your device. Here's how and why. On Monday, Apple released version 26.5.2 for iOS, iPadOS, and MacOS. To update, head to Settings (System Settings on a Mac), select General, and then select Software Update. Download and install the latest update for your device. Also: I replaced my iPhone battery at the Apple store for the first time ever - and learned a valuable lesson A few of the patches address bugs in the OS kernel, while most focus on security flaws in Apple's WebKit browser engine. On the plus side, none of the 29 patched vulnerabilities are zero-days that have been reported as exploited in the wild. Then why the urgency? Hackers can still exploit any of the vulnerabilities, especially now that they're public knowledge. That means anyone who hasn't updated is at risk. For example, the bugs in WebKit could allow an attacker to install malware or steal sensitive data. Also: How I use Siri mode in the iOS 27 Camera app to ask questions about anything I see Plus, Apple decided to fix these bugs earlier than expected. The patches had already been available in the current beta releases for iOS 26.6, iPadOS 26.6, and MacOS 26.6. This indicates that Apple planned to add them to the official 26.6 releases, expected in early or mid-July. Blame it on AI Why did Apple roll them out now? Here's a familiar refrain: Blame it on AI. In a story published Monday (subscription required), Apple told Reuters that it's deploying a series of software updates that would otherwise have been included in a new version of its operating systems. The company said that the change in plans is a response to AI-driven security concerns. Also: I was jealous of these 4 iOS 27 features - then I realized my Android phone already has them Apple needs to adapt to the new reality in which attackers use AI to speed up the development of malicious hacking tools, the company explained to Reuters. That means it has to reduce the amount of time between the initial announcement of new security fixes and their actual release to the general public. This points to a growing trend in the software world. Companies like Apple and Microsoft typically wait until the next regular update cycle to deploy patches for the latest security holes. But AI is a powerful tool, especially in the hands of the wrong people. As cybercriminals weaponize AI, security threats quickly become more exploitable. Also: Apple Maps vs. Google Maps: I used both navigation apps for years, and one is much better With this growing trend, companies can no longer afford to wait until the next major update to patch serious security bugs.

Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs

Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security. The WebKit vulnerabilities are listed below - * CVE-2026-43707 - A memory corruption issue that could result in an unexpected process crash when processing maliciously crafted web content. It was addressed with improved memory handling. * CVE-2026-43716 - An unspecified issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved memory handling. * CVE-2026-43745 - An out-of-bounds write issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved input validation. * CVE-2026-43715 - A use-after-free issue that could result in memory corruption when processing maliciously crafted web content. It was addressed with improved memory management. The first three security defects have been credited by Apple to OpenAI Codex Security, while Anthropic researchers Milad Nasr and Nicholas Carlini, along with Claude, have been acknowledged for CVE-2026-43715. The four vulnerabilities are part of nearly 30 vulnerabilities that have been patched in WebKit, an open-source web browser engine developed by Apple. Others include a use-after-free issue in WebKit Canvas (CVE-2026-43720) and a vulnerability that could be exploited by a malicious website to process restricted web content outside the sandbox (CVE-2026-43725). Apple has also remediated three bugs that could be exploited by a malicious app to leak sensitive kernel state (CVE-2026-43722), cause unexpected system termination or write kernel memory (CVE-2026-43724), or corrupt kernel memory (CVE-2026-39868). Security researcher Hyunwoo Kim, who discovered Dirty Frag, has been credited with discovering and reporting CVE-2026-43724 and CVE-2026-43722. The updates are available for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. None of the patched vulnerabilities has been disclosed as actively exploited in the wild. In a statement shared with Reuters, Apple said it's making the security updates much earlier than before in response to concerns that AI tools could accelerate the development of exploits and act as an enabler of cyber warfare, shrinking the window between discovery and weaponization to hours. The company said "it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it ⁠needed to reduce the time between when updates were first made public and when they were put into customers' hands," Reuters reported.

Apple says it is shipping security updates early as AI speeds up hacking

The company is pulling fixes out of its annual iOS cycle and pushing them sooner, an admission that AI is compressing the window attackers need. For years Apple released most of its security fixes the way it releases everything else, on a schedule, bundled into the next big version of iOS and delivered when the company was ready rather than when the flaw was found. That timetable now has a new constraint, and Apple has decided it can no longer keep to it. The company says it is pushing software updates out earlier than usual, breaking them out of the annual cycle, because artificial intelligence is shortening the time attackers need to weaponise a known weakness. Apple told Reuters on Monday that it was adapting to a simple and uncomfortable reality. As AI accelerates the development of malicious hacking tools, the gap between the moment a vulnerability becomes public and the moment it is exploited has narrowed, and the company needs to compress the gap on its own side to match. The fix needs to reach the phone before the exploit does. The change is procedural rather than dramatic, which is part of why it is notable. Apple is not announcing a new product or a new defensive technology. It is changing the cadence of an existing one, moving fixes that would previously have travelled inside a larger iOS release into earlier, standalone updates. For a company whose security posture has long rested on tight control of timing, loosening that grip in the name of speed is a meaningful concession. Apple was careful about what it was and was not claiming. The company said there was no evidence that any of the newly patched vulnerabilities had actually been exploited. The argument is preventive: not that attackers have already used these flaws, but that the time between disclosure and deployment is itself the risk, and that AI has made that interval more dangerous than it used to be. The logic is familiar to anyone who follows vulnerability research. The hardest part of turning a disclosed bug into a working exploit has traditionally been the labour, the slow reverse-engineering of a patch to find the hole it closes. Tools that can read code, summarise a diff, and suggest an approach lower that cost, which means a fix announced on Tuesday can plausibly be weaponised by an attacker faster than before. Shrinking the deployment window is Apple's answer to a shrinking exploitation window. The move fits a broader pattern in which AI is reshaping both sides of the security contest at once. The same systems that help defenders trawl their code for weaknesses help attackers do the same, and the institutions racing to deploy AI internally are discovering that the identity and access controls built for human users translate awkwardly to swarms of autonomous agents. Apple's adjustment is one large company's attempt to keep pace with a threat curve that AI keeps bending steeper. It also lands at an awkward moment for Apple's own AI ambitions, which have repeatedly stumbled into trouble, from accidental rollouts to regulatory delays. The contrast is pointed: a company still struggling to ship its consumer AI features cleanly is moving quickly to defend against the security consequences of everyone else's. Apple did not specify how much earlier the updates would arrive, or which categories of fix would be pulled forward, leaving the practical scope of the shift to be read from future releases rather than from the announcement. What the company did make explicit is the reasoning, and the reasoning is the news. A patch is only protection once it is installed, and Apple has concluded that, in an age of AI-assisted attackers, the slowest part of that process is no longer one it can afford.

Apple accelerates security updates in response to AI-powered hacking risks

Today's iOS, iPadOS, and macOS 26.5.2 updates include security fixes that Apple had originally planned to release with version 26.6 of each operating system. Here's why the company pushed them out early. Apple fast-tracks security fixes After Apple released iOS 26.5.2, iPadOS 26.5.2, and macOS 26.5.2 today, the company published detailed security content for each update, including the full list of vulnerabilities they addressed. Those included fixes for vulnerabilities in the kernel, WebKit, and WebRTC. In those same notes, Apple said that the updates also included security fixes that had first been made available through the iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 betas, meaning the company decided to release them to the public earlier than originally planned. As to why Apple did this, it told Reuters that the move is a direct response to new threats enabled by increasingly powerful AI models: The company told Reuters on Monday it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it ⁠needed to reduce the time between when updates were first made public and when they were put into customers' hands. Apple added that "while there was no evidence that any of the newly patched vulnerabilities had been taken advantage of," it still decided to release the fixes early to reduce the time attackers would have to exploit them. AI models keep raising the stakes Apple's decision comes amid growing concern over the cybersecurity capabilities of increasingly powerful AI models, as a widening range of frontier labs release systems capable of finding software vulnerabilities. The US government recently restricted access to Anthropic's Claude Fable 5 and cybersecurity-focused Mythos 5, while OpenAI launched GPT-5.6 Sol, Terra, and Luna through a limited preview subject to additional government safeguards. Similar capabilities are also emerging outside the United States. Tokyo-based Sakana AI says its new Fugu system can rival Anthropic's models across several benchmarks, while China's 360 Security Technology has introduced Tulongfeng, a cybersecurity model it claims can compete directly with Mythos just days after Z.ai made similar claims about its latest GLM-5.2 models. To read Reuters' full report on Apple's decision to move up its security updates, follow this link. Worth checking out on Amazon

Apple Released iOS 26.5.2 Security Fixes Early to Thwart AI-Assisted Hacks

Apple today released iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 with a long list of security fixes that it initially introduced in the iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 betas. Apple told Reuters that it released the updates earlier than planned due to concerns about AI-assisted hacks. The company told Reuters on Monday it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers' hands. Vulnerability fixes are typically included in most Apple software updates, but its major point updates usually include more fixes. Apple intended to release the 25+ security fixes that it introduced today in iOS 26.6 and its sister updates, but didn't want to wait for iOS 26.6 to come out. In its security document outlining the changes, Apple did not say that any of the vulnerabilities that were fixed had been actively exploited, and the company further told Reuters that there was no evidence any of the now-patched vulnerabilities had been taken advantage of. Apple said the time between when the security fixes were announced and when they were deployed needed to be compressed, but did not say which vulnerabilities drove the urgency. Apple is among Anthropic's Project Glasswing partners, and it has been using the Claude Mythos Preview to hunt down and patch vulnerabilities before hackers can use them to breach devices. It's not known if Mythos played a role in Apple's decision to release the fixes ahead of schedule.

Your iPhone is about to get more software updates -- and AI is the reason why

* AI is forcing Apple to deliver security updates more often * iOS 26.5.2 is part of Apple's new update strategy * More updates mean better protection against AI-powered cyberattacks It seems that the number of ways AI is changing the world is increasing. The requirement for more RAM to run new AI features in Apple products is already being blamed for the recent price increase in Apple products, as well as for the current high price of RAM itself. Now, according to a recent Reuters report, AI is also to blame for the number of iOS and macOS updates we'll need to install. The bad news is that it's going up, all because of the threat posed by the latest AI models and their potential to aid cyberattacks. Instead of waiting for the next scheduled operating system update for the latest round of security fixes to arrive, Apple is now delivering individual security updates ahead of the next iOS and macOS 26.6 update. iOS 26.5.2 is here now If you look in Settings > General > Software Update on your iPhone, you'll see that iOS 26.5.2 is waiting for you now, unless your iPhone already installed it overnight. The description for the update reads, rather vaguely: "This update provides security fixes for your iPhone," but it's the dangers posed by AI that are driving this update, so make sure you install it promptly. Details of the security updates for all Apple operating systems are available on the Apple Security Updates page. Malicious hacking tools The Reuters article states that the urgency of the update is due to the risk that AI now poses to Apple devices. "The company told Reuters on Monday it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers' hands." It looks increasingly likely that this will become the new normal for security updates, and companies like Apple won't be able to rely on bundling the latest security fixes into the next scheduled operating system update. Stand-alone security patches delivered whenever they're needed are something we're all going to have to get used to. While it might be annoying to keep updating our tech gadgets more often, it's a small price to pay for better security in the AI era. We'll just have to get used to software updates being less about new features and more about staying ahead of increasingly sophisticated cyberattacks. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

AppleInsider.com

AI is now helping hackers find and exploit security issues faster than ever before. Apple says it will no longer wait to include updates in the next scheduled releases of iOS, iPadOS, and macOS. Following a trio of security updates to iOS, iPadOS, and macOS, Apple has announced that it now intends to cut the time between discovery of an exploit and the update to address it. Normally some more minor security updates would have been held until the next regular release, but now they should be issued as soon as possible. According to Reuters, Apple says that this is why there was a release of iOS 26.5.2 on Monday. Previously, the company would typically have included these security updates in iOS 26.6, which is expected in July 2026. There were exceptions when the security issue was considered severe enough to merit that "sub-point" release, but they were few and far between. And in particular, if an active hacking campaign were found to be exploiting such a flaw, Apple would not delay a release. With the update to 26.5.2, Apple says that there is no evidence that the vulnerabilities it patched have been exploited. But the update included over 25 separate security fixes, and so Apple released it just under a month since it launched 26.5.1. The 25 vulnerabilities included 15 that were to do with WebKit, the engine that browsers on iOS are required to use, at least in most territories. The security issues included an ability for certain web content to retrieve sensitive information, and one where websites could capture whatever is on the user's clipboard. Apple has not said whether it has evidence that AI was used to discover and exploit these issues. While it may have such evidence, the company could also be presuming AI is involved based on the volume of hacks being detected. In this case, the number and type of vulnerabilities was sufficient to make Apple release this update as soon as possible, but there were benefits to holding back updates. If users get too many notifications to update, for instance, they may stop doing it. Then, too, if there is time before the next release, Apple's engineers and other security experts can more fully check for whether the update has introduced new bugs. Apple's announcement follows the news in May 2026 that Anthropic's Mythos AI circumvented macOS security. It did so by examining two separate bugs instead of finding a single vulnerability. Mythos is an early version of an update to Anthropic's Claude AI model. Anthropic's own engineers have cautioned that it is too good at finding security exploits. It was initially given a limited release in early June 2026, but within days was withdrawn by order of the US government over national security concerns. The version of Mythos that beat macOS security was a pre-release model. Apple patched that exploit with the May 2026 release of macOS Tahoe 26.5. There are clearly more coming. Heightened security If AI is helping create hacking tools faster and in great volumes than before, then there's no option. Apple has to patch every vulnerability as it's found, and it has to release those security updates as quickly as possible. There is a genuine risk of burnout with users opting not to update. Apple does have Background Security Improvements (previously known as Rapid Security Response), which lets it install updated system files. But even that is a toggle so a user can choose not to allow it. Hopefully such users will eventually be prompted to when Apple's annual updates offer more features, but that means those users being exposed for up to a year. Then patching these vulnerabilities is not always straightforward, and it is always a bigger issue than it seems. The patch has to be worked into the next and all future versions of the OSes, and it may have to also be integrated into previous ones as well. For instance, the iPhone XR, iPhone XS, and iPhone XS Max phones cannot be updated to iOS 26. So if an exploit is severe enough, Apple has to update iOS 25 with the patches too. That's a potentially huge job and it raises the risk of the patches introducing new bugs, too. It's possible to foresee a time when Apple will make automatic installation of updates the default, if it doesn't remove the ability to opt out of that altogether. It's possible to see Apple following the likes of subscription services and moving from annual major updates to a rolling, automatic release of new versions. Yet there is a reason to avoid automatic updates. It's when an OS is first released that it is most likely for users to find bugs, so just being able to wait a few days for those to be fixed is sensible. So there is no great solution, but Apple putting resources into releasing patches faster is the best we're going to get.

Update Your iPhone Now: Apple Just Pushed an Urgent Fix as AI-Powered Threats Increase

AI is turbocharging cybersecurity threats -- and Apple has begun dispatching updates to its iPhones and tablets faster to combat them. Apple released iOS 26.5.2 on Monday for iPhone 11 and later, alongside corresponding updates for iPads. Historically, Apple would have waited until iOS 26.6 to wrap this latest round of security patches within its broader software update. But according to a report from Reuters, the tech giant has begun accelerating the deployment of cybersecurity updates in response to how AI has itself accelerated the development of malicious hacking tools and the time hackers need to exploit security flaws. Apple is habitually vague about what the security updates are meant to address, noting in Monday's announcement that for "customers' protection," it "doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available." Some of the impact statements included in the announcement did, however, offer insight into the broad nature of the vulnerabilities addressed by the update. There were, for example, close to 20 updates for WebKit (the browser engine used by Safari), Mail, and other apps. One impact statement noted that "a malicious website may be able to silently hijack clipboard data," whereas as others mentioned that malicious content could cause various processes to crash, memory corruption, or could "disclose sensitive user information."

Apple Says It Is Releasing Updates Early in Response to AI Cybersecurity Concerns

WASHINGTON, June 29 (Reuters) - Apple ⁠said ⁠it is pushing forward ⁠a series of software updates that would previously have been bundled with a new version of its iOS operating system, making them available earlier than in previous cycles in response to AI-driven security concerns. The ⁠company ⁠told Reuters on Monday it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into ⁠customers' ⁠hands. The shift marks a ⁠notable change in Apple's longstanding practice of packaging security fixes with broader software releases, an acknowledgment ⁠that AI is compressing the window attackers need to exploit known flaws. Unless security experts discover a hacking campaign targeting a previously unknown software flaw, Apple usually releases security updates as part of ⁠a move from one version of iOS to the next, for ⁠example from the currently available version - 26.5 - to the next planned update, 26.6. In the interim, developers and other testers trial the next update to iron out any kinks. The company said that, instead, the latest round of security updates were being made available to everyone ahead of the wider release of 26.6. It said that while there was no ⁠evidence that any of the newly patched vulnerabilities had been taken advantage of, the time between the point when security fixes were first announced and when they were deployed to customers' phones needed to be compressed. (Reporting by Raphael Satter; Editing by Sanjeev Miglani)

Why Apple's New Security Fixes May Have Arrived Earlier Than Expected

New security updates were earlier spotted in iOS 26.6 beta versions Apple released the iOS 26.5.2 update, along with the iPadOS 26.5.2 version, for select iPhone and iPad models. The new OS versions bring various security fixes that were first available with the iOS 26.6 and iPadOS 26.6 beta versions, and were expected to be generally available when those updates rolled out. However, instead of the stable version of iOS 26.6, Apple decided to introduce a new iOS 26.5.2 update, on the stable channel, stating that AI-backed malicious hacking tools were the reason for the accelerated release timeline. Available for iPhone 11 and newer models, the latest firmware version fixes an issue that may have allowed an app to cause unexpected system termination. iOS 26.5.2, iPadOS 26.5.2 Arrive With Important Security Fixes The Tim Cook-led tech giant told Reuters that it has accelerated the release timeline for new security updates to adapt to the new reality, as AI enables faster "development of malicious hacking tools". The company reportedly said that it wants to reduce the time between the first public release of an update and the rollout of the stable version to users. With this, Apple could be looking to give bad actors less time to find vulnerabilities, even before it is released to a wider user base. The company usually releases major security fixes with bigger OS updates, while reserving the smaller updates for other bug fixes, unless a new security flaw is discovered after the OS version has been rolled out. The company reportedly acknowledged that AI is reducing the time a bad actor needs to exploit a security flaw to hack devices. iOS 26.5.2 fixes an issue that allowed apps to write kernel memory Apple released the latest iOS 26.5.2 and iPadOS 26.5.2 updates for select phones and tablets on Monday. In the release notes, the Cupertino-based tech giant revealed that the new firmware versions bring security fixes that were first made available with the beta versions of the iOS 26.6 and iPadOS 26.6 updates. These security fixes were expected to be rolled out to a wider user base with the stable versions of both updates. Among many issues, the iOS 26.5.2 update fixes a vulnerability that allowed apps to cause system termination, along with another issue that allowed apps to also write kernel memory. The company reportedly said that it has not found any evidence that the newly patched vulnerabilities have been exploited yet.

iOS 26.5.2 sounds like a sign of things to come for Apple software updates

Apple is warning that the use of AI to find vulnerabilities in iOS is making it harder to keep the software watertight Apple is making a point of releasing a number of iPhone security fixes it would have previously bundled into the soon-to-be-released iOS 27, as a sign of the changing face of cyber security operations at the company and the tech world at large. iOS 26.5.2 came out on Monday and contains 29 fixes, many of which are in response to rapidly emerging security concerns pertaining to generative AI. Mostly, they're fixes for kernels and webkit vulnerabilities. Thankfully, Apple says that the potential exploits have not been taken advantage of in the wild. The Reuters report says: "The company told Reuters on Monday it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it ⁠needed to reduce the time between when updates were first made public and when they were put into customers' hands." That's quite terrifying in a way. But it's good to hear Apple is responding in real time. And, as Reuters says, the release is "compressing" the time Apple has to respond to threats. There's no putting the genie back in the bottle now. AI is here to stay, for better or worse. The companies that respond fastest to the inherent security threats will probably be the ones that gain the most consumer trust. What sort of future are we looking at though?Hourly software updates to eliminate the threats of the day? "With recent AI advances, we are seeing vulnerability finding times dramatically reduce, which makes patching that much more difficult," says Jake Moore, global cybersecurity advisor at ESET told Forbes. "Waiting for large updates to cover smaller known vulnerabilities over a long period of time might be a thing of the past now with such tools that even more rapidly search for any possible exploits."