Apple fixed 329 unique security flaws in a single day of updates on 26 October, covering the iPhone, iPad, Mac, Apple Watch, Apple TV and Vision Pro. The tally comes from 9to5Mac, which counted Apple’s per-release advisories: because many flaws affect several operating systems, the combined total runs to 1,265 CVE listings. Apple itself publishes advisories per release and does not give a combined headline total, so the 329 figure is 9to5Mac’s count, not Apple’s. One caveat travels with it, also from 9to5Mac: the counts may still increase, as Apple regularly adds entries to its advisories after publication.
That gap between 329 and 1,265 is worth understanding before the number impresses or worries you. Our own arithmetic on 9to5Mac’s two figures gives 3.84 listings per unique flaw across the counted set, a sign of how often one flaw spans several operating systems. No single device receives all 1,265 listings. Each device gets only the fixes that apply to its own operating system and hardware, so the headline counts advisory volume, not the number of fixes landing on your phone.
The round is also unusual for how far back it reaches. Apple patched three branches on the same day: the current branch in iOS 27.2 and iPadOS 27.2, the previous branch in iOS 26.7.2 and iPadOS 26.7.2, and the 2018-era branch in iOS 18.7.11 and iPadOS 18.7.11 for the iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad. That is an eight-year device span in one patch round. The current branch covers iPhone 11 and later, the previous branch covers the same iPhone range plus older iPads, and the Mac side spans macOS Golden Gate 27.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2, with Safari 27.2 for Sequoia and Tahoe. Apple Watch Series 9 and later got watchOS 27.2, Apple TV 4K second generation and later got tvOS 27.2, and every Apple Vision Pro got visionOS 27.2. One small release, tvOS 26.6.1 for the Apple TV HD and first-generation Apple TV 4K, carries no published CVE entries at all, according to 9to5Mac and Apple’s own security releases index.
On the iPad side, the current branch covers iPad Pro 12.9-inch fourth generation and later, iPad Pro 11-inch second generation and later, iPad Air fourth generation and later, iPad ninth generation and later, and iPad mini sixth generation and later. The previous branch reaches a generation further back on every iPad line, down to the eighth-generation iPad and the fifth-generation iPad mini.
Four named fixes show what kind of flaws these were. In CoreMedia, CVE-2026-86990 meant a malicious app could access the camera on an iPhone, iPad, Mac or Apple Vision Pro without permission. In Apple Intelligence, CVE-2026-86987 meant a remote attacker could access sensitive user data on supported iPhones and iPads. In Siri on macOS Tahoe, CVE-2026-43736 meant an app could access sensitive user data. And multiple WebKit flaws meant maliciously crafted web content could execute arbitrary code. 9to5Mac also notes that Apple credited AI tools and research teams for several of the vulnerabilities, part of a recent WebKit patching spree partly driven by growing use of AI tools to uncover flaws.
One exploited flaw in this story needs careful placement, because it is easy to misread. The round brings a previously released CoreGraphics fix, CVE-2026-86950, to devices still running iOS 18 and iPadOS 18. Apple first addressed that flaw in September 2026, warning it may have been exploited in an extremely sophisticated attack against specific targeted individuals running versions of iOS before iOS 27. That exploitation warning dates to the September fix, and the October round carries the same fix to iOS 18 devices. In fact, CVE-2026-86950 was already in CISA’s exploited-vulnerabilities catalogue, added 29 September, before this round. No newly disclosed flaw in the 27.2, 26.7.2 or 18.7.11 batch has been flagged as exploited, so this is a routine patch roundup, not a breach, a leak or an emergency response to an attack in progress.
The timing itself tells a small story. The operating-system updates shipped during 26 October daytime, with iClarified’s release post timed at 19:00 UTC, while the detailed security content only appeared that evening in 9to5Mac’s tally at 20:56 UTC. Early updaters installed without CVE detail, and Appleosophy noted earlier in the day that Apple’s security page had not yet been updated. If you updated on the day, you were protected before you could read exactly what you were protected from.
What should you do with this? Install the version for your branch. If your iPhone runs iOS 27, that is iOS 27.2. If you have stayed on the previous branch, iOS 26.7.2 is a security-focused update with no new features, according to 9to5Mac. If you still use an iPhone XS, XS Max or XR, iOS 18.7.11 is your update. The current branch also brings non-security content, with Siri AI gaining retained context from previous interactions plus Suggestions in Messages, according to Appleosophy and iClarified’s release notes. And keep one watch in mind: because Apple adds advisory entries after publication, the 329 total may yet move, and whether any newly disclosed flaw from this batch later joins CVE-2026-86950 in CISA’s exploited-vulnerabilities catalogue remains to be seen.
