InfoSecBulletin Cybersecurity for mankind
Apple released security updates on Monday for iOS, macOS, and Safari. These updates fix more than thirty issues, including four problems in WebKit found using AI tools like Anthropic Claude and OpenAI Codex Security.
The WebKit vulnerabilities are listed below:
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
CVE-2026-43707: A memory corruption issue that could result in an unexpected process crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43716: An unspecified issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43745: An out-of-bounds write issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved input validation.
CVE-2026-43715: A use-after-free issue that could result in memory corruption when processing maliciously crafted web content. It was addressed with improved memory management.
The first three security issues were given to Apple by OpenAI Codex Security. Also, researchers Milad Nasr and Nicholas Carlini from Anthropic, along with Claude, were recognized for CVE-2026-43715.
The four flaws are part of almost 30 flaws fixed in WebKit, a web browser engine made by Apple. Other issues include a use-after-free problem in WebKit Canvas (CVE-2026-43720) and a weakness that a bad website could use to handle restricted web content outside the sandbox (CVE-2026-43725).
Apple has fixed three problems that a bad app could use to leak secret data (CVE-2026-43722), crash the system (CVE-2026-43724), or damage kernel memory (CVE-2026-39868). Security researcher Hyunwoo Kim, who found Dirty Frag, is recognized for finding and reporting CVE-2026-43724 and CVE-2026-43722.
The updates are out for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. No known flaws from these updates are being used by hackers.
Apple said it is now making security updates sooner than before. This change comes from worries that AI tools might speed up creating exploits and help in cyber warfare, reducing the time between finding a problem and using it to hours.
The company said “it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers’ hands,” Reuters reported.
