InfoSecBulletin Cybersecurity for mankind
Apple released security updates on Monday for iOS, macOS, and Safari. These updates fix more than thirty issues, including four problems in WebKit found using AI tools like Anthropic Claude and OpenAI Codex Security.
The WebKit vulnerabilities are listed below:
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
CVE-2026-43707: A memory corruption issue that could result in an unexpected process crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43716: An unspecified issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved memory handling.
CVE-2026-43745: An out-of-bounds write issue that could result in an unexpected Safari crash when processing maliciously crafted web content. It was addressed with improved input validation.
CVE-2026-43715: A use-after-free issue that could result in memory corruption when processing maliciously crafted web content. It was addressed with improved memory management.
The first three security issues were given to Apple by OpenAI Codex Security. Also, researchers Milad Nasr and Nicholas Carlini from Anthropic, along with Claude, were recognized for CVE-2026-43715.
The four flaws are part of almost 30 flaws fixed in WebKit, a web browser engine made by Apple. Other issues include a use-after-free problem in WebKit Canvas (CVE-2026-43720) and a weakness that a bad website could use to handle restricted web content outside the sandbox (CVE-2026-43725).
Apple has fixed three problems that a bad app could use to leak secret data (CVE-2026-43722), crash the system (CVE-2026-43724), or damage kernel memory (CVE-2026-39868). Security researcher Hyunwoo Kim, who found Dirty Frag, is recognized for finding and reporting CVE-2026-43724 and CVE-2026-43722.
The updates are out for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. No known flaws from these updates are being used by hackers.
Apple said it is now making security updates sooner than before. This change comes from worries that AI tools might speed up creating exploits and help in cyber warfare, reducing the time between finding a problem and using it to hours.
The company said “it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers’ hands,” Reuters reported.
