Apple iOS 26.6 is out. As well as promising to get you ready for iOS 27 (heigh ho!), there are lots of security fixes. None of these seem to be zero-days, but in plain language, there are one or more vulnerabilities of all these types, in no particular order ("Sec" = security bypass, "DoS" = denial of service, "EoP" = elevation of privilege, and "RCE" = remote code execution): Sec: Mirrored iPhones could leak sensitive data. Sec: Apps could track users via cookie-like telltales in device data. Sec: Apps could access sensitive data. DoS: Apps could crash the system. RCE: Booby-trapped data files could inject rogue code. EoP: Apps could acquire kernel-level powers. Sec: Apps could delete protected files. RCE: Unsigned apps could bypass attestation (!). Sec: Apps could add contacts without permission. Sec: Apps could read contacts without permission. Sec: Authentication tokens could end up on the wrong server (!). Sec: Sensitive data could be stolen from the Lock Screen (yet again). EoP: Apps could extract secret data from the kernel. EoP: Apps could get access to the root account. Sec: Websites could track clicks made from other pages. Sec: Web pages could present someone else's site name. Act now, folks! Visit Settings > General > Software Update as soon as you can.