Apple shipped iOS 26.5.2 on June 29 with more than two dozen security fixes and no actively exploited zero-day. The real story is the timing: Apple is now pushing patches out ahead of the next major release, and told Reuters that AI-accelerated hacking is why.
Apple's April 22 patch fixes a single CVE — but it's the one 404 Media reported the FBI was using to pull deleted Signal messages out of the iPhone's notification database.
Apple's iOS 26.4.1 fixes a CloudKit syncing regression that silently broke data sync across iPhones and iPads — including the Passwords app — while extending Stolen Device Protection to enterprise devices.
Apple's iOS 26.4 patches 37 security vulnerabilities — including a Stolen Device Protection bypass and a Keychain access flaw — while enabling Stolen Device Protection by default for all iPhones.
If your iPhone or Mac updated itself overnight without a full version bump, you just experienced Apple's first Background Security Improvement — a quiet replacement for the failed Rapid Security Responses.
Apple's iOS 26.3.1 is a minor maintenance release timed to the March hardware event — adding support for the iPhone 17e and new Studio Displays, with unspecified bug fixes and no security patches.
Apple's iOS 26.3 patches 40 security vulnerabilities including an actively exploited spyware zero-day, adds a first-party Transfer to Android migration tool built for EU compliance, and opens iPhone notifications to third-party wearables in Europe.