Apple has released four security updates to bring several of its supported operating systems into sync with current OS 27 betas and other previous releases. In each case, the company introduces the release notes with a sentence along the lines of “This update delivers security fixes that were first made available in the macOS Golden Gate 27 beta.” The updates include:
macOS 26.6.2 Tahoe: Fresh off the macOS 26.6.1 update that addressed a Screen Sharing vulnerability, macOS 26.6.2 fixes 29 vulnerabilities.
iOS 26.6.1 and iPadOS 26.6.1: Because iOS and iPadOS didn’t need the macOS Screen Sharing fix, their version number lags behind macOS by one. Nevertheless, iOS 26.6.1 and iPadOS 26.6.1 address 30 vulnerabilities, nearly all of which overlap with the macOS fixes. iOS 26.6.1 addresses one vulnerability not found in macOS 26.6.2: a Telephony flaw that could allow a privileged network attacker to bypass IPsec authentication and intercept traffic.
visionOS 26.6.1: Apple says, “Details coming soon,” and provides no link. I haven’t heard of any real attack aimed at visionOS—the installed base may not yet justify the effort for attackers.
Apple doesn’t identify any of the vulnerabilities as having been exploited in the wild, so you can wait a few days before installing these updates to make sure they don’t come with unexpected side effects. That said, given the number of kernel and WebKit fixes, you should update soon.
What’s most notable about these updates is the number of vulnerabilities that appear to have been discovered with AI assistance. Nine WebKit vulnerabilities are credited to “OpenAI Codex Security – Amy Burnett,” and another is credited to “Dung Do (@_piers2) of Calif.io,” a security firm that leverages AI heavily. Combined with the AI-credited discoveries in the earlier OS 26.6 releases—including vulnerabilities found with Anthropic’s Claude and the Chinese GLM model—it’s clear that AI-assisted security research is becoming a growing source of vulnerability reports.
I suspect Apple will soon bring older versions of macOS into sync as well, with releases of macOS 15.7.10 Sequoia and macOS 14.8.10 Sonoma, along with Safari 26.6.2, which would carry all the WebKit fixes. We’ll see!
Sadly, no sign of iOS 18.7.10 on my 2022 iPhone SE, so I guess Apple are persisting with their view that I need to upgrade to iOS 26 for up-to-date security. I guess these latest fixes aren’t deemed critical enough.
I just updated my desktop Mac to 26.6.2 and my phone to 26.6.1. Now iPhone Mirroring no longer works. It just says “Connecting” and then times out after about a minute. I tried de-authorizing the phone and re-authorizing it; I tried plugging the phone into a USB-C cable attached to the Mac, all to no avail.
I just happened to watch this youtube https://www.youtube.com/watch?v=rRluznx8_8c before reading here, but it mentions something not in the article, which is that older Macs should turn off screen-sharing because that is now an open vulnerability. I have an old High Sierra iMac and I’m going to follow that advice.
(Mr. Macintosh: “macOS Tahoe 26.6.2 Update - Here We Go Again!!!”)
Maybe wait a bit before deciding to get angry. Apple always rolls out updates first to the latest OS versions. If they are going to be back-ported to older releases, those typically follow a few days later, often without any advance notice.
The Mac update did something surprising on my machine: it restarted and brought up the Finder without passing through the password challenge, even though the Mac is configured to require the password on login. I regard that as a serious bug.
My router (Synology WRX56) has port 5900 blocked by default. I scanned all router settings and there are no instances of port forwarding or non-standard ports open.
I then used this command
nc -zv <my_IP_Address> 5900
and got this response:
nc: connectx to <my_IP_Address> port 5900 (tcp) failed: Connection refused
So my conclusion is this router successfully blocks incoming connections on port 5900.
That has been normal for a very long time now. As long as you are logged in when you start the update process, it will always return you to the logged on user after completing the update and restarting. It assumes you remain or return to the computer after starting the update. If you don’t do something within a few minutes it will require a login.
An easy-to-use and long established port scanner is ShieldsUP. The “classic” webpage design and interface won’t win any awards but the scanner will both scan specific ports, including 5900, and a range of commonly used ports.
The updater asked me for my admin password (not TouchID, …?) before updating. I assume that would not only authorize the update itself but also the following login.
I was not aware that this only works if you remain there doing work and that it will require actual authentication otherwise, as @alvarnell points out above.
On macOS, I’ve found this only to be the case when FileVault is enabled. If it’s not enabled, then it automatically logs in to a session that was saved before the update-reboot.
Which makes sense, because you need to first unlock the storage volume before the OS can fully boot.
Several of the Mac 26.x updates (including 26.6.2) have reset my custom setting in Safari > Settings > General > File download location to the default Downloads folder.
