Apple has issued iOS 26.6.1 and iOS 18.7.10, containing dozens of security fixes for iPhones.
Apple doesn’t provide much detail about what’s fixed in iOS 26.6.1 and iOS 18.7.10, to give iPhone users as much time as possible to upgrade before attackers can get hold of the details.
But both the iOS 26.6.1 and iOS 18.7.10 updates patch serious issues in WebKit, the engine that underpins Apple’s Safari browser. They land nearly three weeks after iOS 26.6 patched 90 issues. No iOS 18 update was released at the time.
WebKit issues are serious and are often part of attack chains that can allow spyware onto iPhones. Meanwhile, issues that target the iPhone Kernel allow attackers to aim at the heart of iOS, which can allow complete control of the device.
WebKit and Kernel fixes such as those patched in iOS 26.6.1 and iOS 18.7.10 “are the more important updates to look out for,” says Jake Moore, global cybersecurity advisor at ESET. “WebKit flaws are particularly worrisome as they can potentially become triggered simply through malicious web content, which the iPhone cannot control,” he explains.
Kernel vulnerabilities “go one stage further” and “can give attackers deep access to a device to carry out a full range of attacks,” says Moore.
The iOS 26.6.1 and iOS 18.7.10 updates come as Apple has issued a warning that spyware is targeting iPhones. However, the iPhone maker does not say any of the bugs squashed in iOS 26.6.1 and 18.7.10 have been exploited in real-life attacks yet.
What’s In iOS 26.6.1
The iOS 26.6.1 update fixes three flaws in the iPhone Kernel and nearly 20 in WebKit.
Tracked as CVE-2026-65346, an issue in ImageIO could lead to arbitrary code execution, according to Apple’s support page.
The update comes just over a week after Apple issued macOS 26.6.1 for Macs.
What’s In The iOS 18.7.10 Update
The iOS 18.7.10 update contains an even longer list of flaws, including over 30 in WebKit and over a dozen in the Kernel.
The iOS 18.7.10 update is arguably more interesting because it shows Apple is “pushing security fixes to older devices as well,” says Moore.
“Some of the vulnerabilities located could allow malicious images to execute code on the device and even reach into the kernel making the device insecure,” says Moore.
These are the same sort of attacks used to plant spyware on a iPhone, via so-called zero-click attacks where a user only has to receive an image on WhatsApp or iMessage to become a victim.
The iOS 18.7.10 update also includes CVE-2026-43818, an issue in ImageIO that could enable arbitrary code execution.
Why You Should Update to iOS 26.6.1 Or iOS 18.7.10
The issues fixed in iOS 26.6.1 and iOS 18.7.10 are serious and once the details are out there, it can open the door to more attackers. The updates also come as Apple says it is making changes to its update cycle as more flaws are discovered using AI.
Since automatic updates can take a while to reach all users, it is important that you update to iOS 26.6.1 and 18.7.10 now.
Moore says it is essential that users “update their devices as soon as possible.”
I agree. Go to your Settings > General > Software Update and upgrade now to iOS 26.6.1 or iOS 18.7.10.