Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs

Apple has released security updates for iOS, macOS, and Safari, patching over 30 vulnerabilities, including four WebKit flaws discovered using AI tools like Anthropic Claude and OpenAI Codex Security. The WebKit vulnerabilities are CVE-2026-43707 (memory corruption), CVE-2026-43716 (unspecified crash), CVE-2026-43745 (out-of-bounds write), and CVE-2026-43715 (use-after-free). Three of these were credited to OpenAI Codex Security, while Anthropic researchers Milad Nasr and Nicholas Carlini, along with Claude, were acknowledged for CVE-2026-43715.

Other patched flaws include a use-after-free in WebKit Canvas (CVE-2026-43720) and a sandbox escape (CVE-2026-43725). Apple also fixed three kernel bugs (CVE-2026-43722, CVE-2026-43724, CVE-2026-39868) that could leak sensitive kernel state, cause system termination, or corrupt kernel memory. Security researcher Hyunwoo Kim (discoverer of Dirty Frag) reported CVE-2026-43724 and CVE-2026-43722.

The updates are available for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. None have been exploited in the wild. Apple stated it accelerated the release to counter AI-driven exploit development, reducing the window between discovery and weaponization.