iOS 26.6.1 Security Update: What Apple Fixed and Who Gets It

Apple pushed a security-only update to iPhones and iPads on August 17, 2026. iOS 26.6.1 closes 29 vulnerabilities, older iPhones get iOS 18.7.10, and Macs receive matching fixes in macOS Tahoe 26.6.2. Here’s what changed and why to install this week.

#What Apple Released on August 17

Apple published three advisories at once. According to Apple’s security releases index, the August 17 wave covers iOS 26.6.1 and iPadOS 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, macOS Tahoe 26.6.2, and visionOS 26.6.1. The same index confirms that 26.6.1 is now the latest iOS and iPadOS version.

The August 17, 2026 security releases, per Apple’s release index

Timing matters here. Apple’s index shows iOS 26.6 arrived July 27, a macOS-only round followed on August 6, and this wave landed August 17: three security pushes in three weeks.

#What Does iOS 26.6.1 Actually Fix?

According to Apple’s iOS 26.6.1 advisory, the 29 patched flaws cluster in a handful of components. WebKit, the engine behind Safari and most in-app browsers, accounts for 21 of them, mostly crashes and memory corruption triggered by malicious web content. One WebKit History bug went further: Apple states that visiting a maliciously crafted website may leak sensitive data.

The rest of the list is short but serious. Two ImageIO fixes deal with malicious images, and the advisory describes the worse one as arbitrary code execution from simply processing an image (CVE-2026-65346). Three Kernel patches close bugs that could crash the system or corrupt kernel memory, including one a remote attacker could trigger. An Audio fix stops apps from leaking sensitive user information.

No exploitation note appears on any of the three advisories.

#The IPSec Flaw Behind CVE-2026-65329

The most interesting entry sits under Telephony, and it’s the one flaw listed for iPhone only. Apple’s advisory describes the impact this way:

An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic.

In plain terms, someone already positioned on your network path, like a hostile Wi-Fi hotspot operator, could have slipped past an authentication layer your iPhone uses for carrier features and watched traffic that should have stayed protected. Apple says the fix came through improved state management and credits four researchers at Ruhr University Bochum with the find.

Interception bugs deserve faster patching than crash bugs.

A Safari crash announces itself. A traffic-interception flaw works silently, and public Wi-Fi in airports, hotels, and coffee shops is exactly where a privileged network position is cheapest to get. If you travel or work from cafes, this fix alone justifies updating today.

#Older iPhones Get iOS 18.7.10 Instead

The iPhone XS, XS Max, and XR reached their ceiling at iOS 18, so Apple ships them separate security patches. The iOS 18.7.10 advisory lists those three phones plus the iPad 7th generation, and its fix list is far longer: 122 vulnerabilities across dozens of components.

Why so many more? These devices sat out several 26.x-era patch cycles and are catching up in one release.

The batch includes an AVEVideoEncoder bug that Apple states could let an app execute arbitrary code with kernel privileges, plus a Game Center flaw that let a malicious app break out of its sandbox. If someone in your family still carries an XR, that update is more urgent than yours, not less.

Wondering which devices run which build? Our iOS 26 supported devices list breaks down exactly where the compatibility line falls and why the A12 iPhones stayed behind on iOS 18.

#Should You Install It Right Away?

Yes. The patch closes an interception bug, an image-triggered code-execution path, and 21 WebKit holes that malicious web pages can poke at. Every one of those is reachable through ordinary daily use: browsing, opening messages with images, joining public Wi-Fi.

The downside is small. Point releases like this one change no features and no interface, so app compatibility risk is close to nil. The one real consideration is that there’s no going back: Apple’s release index warns that once iOS installs, it can’t be rolled back to the previous version. Since 26.6.1 changes nothing visible, that tradeoff is easy this time, and the low stakes are exactly why same-week installs make sense for point releases.

One caution from experience with earlier iOS 26 point releases: the first day or two after an update like this, background reindexing can make the phone feel warm or drain faster. That settles on its own. If it persists, our iOS 26 battery drain guide walks through the usual causes and fixes.

#How to Install the Update Safely

The update path hasn’t changed. On your own iPhone or any device you manage, go to Settings > General > Software Update, let the phone check, and tap Update Now when iOS 26.6.1 appears. On an iPad the path is identical. Mac users should open System Settings > General > Software Update for Tahoe 26.6.2.

Three quick preparation steps make failures rare:

• Back up first. An iCloud backup or a local computer backup means a mid-update hiccup costs you nothing.
• Free up a few gigabytes. Point updates are small, but tight storage is still the top install blocker. Our System Data storage guide helps if you’re near the limit.
• Plug in and stay on Wi-Fi. The installer can refuse to start on a low battery unless the phone is connected to power.

If the download stalls or the progress bar freezes, don’t panic and don’t force-restart immediately. The fixes in our iOS 26 update stuck guide resolve nearly every hung install without data loss.

#Macs Get the Same Fixes in Tahoe 26.6.2

The Mac side of this wave mirrors the iPhone side. Apple’s macOS Tahoe 26.6.2 advisory lists 28 fixes covering the same Audio, ImageIO, Kernel, and WebKit families, with the iPhone-only Telephony fix as the notable absence. If you updated your Mac for the August 6 Screen Sharing patch, this is a second, separate update on top of it.

Deciding whether your Mac should move to Tahoe at all is a different question, covered in our macOS Tahoe update guide. But if you’re already on Tahoe, 26.6.2 is the same easy call as 26.6.1 on the phone: security-only, nothing visible changes, install it.

#Bottom Line

Install iOS 26.6.1 this week. It’s a small, feature-free patch that closes 29 real holes, including a silent traffic-interception flaw that public Wi-Fi users should care about, and Apple’s advisories show a security team shipping fixes at an unusually fast clip this summer. Hand-me-down iPhones on iOS 18 need their 18.7.10 update even more, with 122 fixes waiting. Back up, plug in, update, and you’re done in one coffee break.

#Frequently Asked Questions