InfoSecBulletin Cybersecurity for mankind
Apple released security updates on Monday for iOS, macOS, and Safari. These updates fix more than thirty issues, including four problems in WebKit found using AI tools like Anthropic Claude and OpenAI Codex Security.
The WebKit vulnerabilities are listed below:
“PentestCode” AI Agent Automating Penetration Testing with 18 Tools
CVE-2026-60137, CVE-2026-63030
Patch immediately! 2 high severity WordPress flaws found
Windows LegacyHive 0, AWS, Fortinet, TP-LINK multiple flaws got hackers attention
CVE-2026-53412
Zoom Warns of critical account takeover Flaw via Network Access
India to built Mythos-like AI model “Sarvam AI” and “BharatGen” assigned
Cursor, SonicWall, SharePoint 0-day exploited to the wild
Microsoft Patch Tuesday July-2026 fixes 570 flaws, 3 zero-days
Fortinet Patches 7 Flaws In FortiOS, FortiProxy, FortiPAM, and FortiSandbox
CISA warns Cisco IOS flaw, while VMware flaw allows bypassing authentication
Meta’s louisiana data center to exceed 250 billion price tag
CVE-2026-43707: A memory corruption issue that could result in an unexpected process crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43716: An unspecified issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43745: An out-of-bounds write issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved input validation.
CVE-2026-43715: A use-after-free issue that could result in memory corruption when processing maliciously crafted web content. It was addressed with improved memory management.
The first three security issues were given to Apple by OpenAI Codex Security. Also, researchers Milad Nasr and Nicholas Carlini from Anthropic, along with Claude, were recognized for CVE-2026-43715.
The four flaws are part of almost 30 flaws fixed in WebKit, a web browser engine made by Apple. Other issues include a use-after-free problem in WebKit Canvas (CVE-2026-43720) and a weakness that a bad website could use to handle restricted web content outside the sandbox (CVE-2026-43725).
Apple has fixed three problems that a bad app could use to leak secret data (CVE-2026-43722), crash the system (CVE-2026-43724), or damage kernel memory (CVE-2026-39868). Security researcher Hyunwoo Kim, who found Dirty Frag, is recognized for finding and reporting CVE-2026-43724 and CVE-2026-43722.
The updates are out for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. No known flaws from these updates are being used by hackers.
Apple said it is now making security updates sooner than before. This change comes from worries that AI tools might speed up creating exploits and help in cyber warfare, reducing the time between finding a problem and using it to hours.
The company said “it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers’ hands,” Reuters reported.
