Apple issued iOS 26.6.1 and iOS 18.7.10 for iPhones, and iOS 26.6.1 fixes three flaws in the Kernel and nearly 20 in WebKit. The update matters because those parts sit close to the browser and the operating system’s core, so bugs there can open the door to more serious attacks on the device.
iOS 26.6.1 and iOS 18.7.10
The two releases arrive nearly three weeks after iOS 26.6 patched 90 issues. Apple is also pushing security fixes to older devices through iOS 18.7.10, which carries over 30 WebKit flaws and over a dozen Kernel flaws.
One of the named issues, CVE-2026-65346 in ImageIO, could lead to arbitrary code execution. The matching issue in iOS 18.7.10 is CVE-2026-43818 in ImageIO, which could also enable arbitrary code execution.
Jake Moore on WebKit risk
Jake Moore of ESET said, “WebKit flaws are particularly worrisome as they can potentially become triggered simply through malicious web content, which the iPhone cannot control,” and he said users should “update their devices as soon as possible.”
He also said Kernel vulnerabilities can “go one stage further” and “can give attackers deep access to a device to carry out a full range of attacks,” which is why a browser-engine fix and a core-system fix in the same release deserves attention from anyone who uses Safari, WhatsApp, or iMessage on an iPhone.
Apple’s quiet release cycle
Apple did not say any of the bugs fixed in iOS 26.6.1 and iOS 18.7.10 had been exploited in real-life attacks yet, even as it says spyware is targeting iPhones. That gap means users are being asked to trust the patch before the full technical detail spreads beyond the company’s update notes.
The practical move is simple: install iOS 26.6.1 now if your iPhone offers it. The only unresolved issue in the public details is which specific iPhone models can install iOS 26.6.1 and iOS 18.7.10.
