CybersecurityVulnerability Management

Apple Bolsters Security with AI-Discovered WebKit Flaw Patches

Analyst 207||Source: TheHackerNews
Modern tech facility with sleek building and laptop in foreground.
"it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it needed to reduce the time between when updates were first made public and when they were put into customers' hands," Apple said, Reuters reported.

Apple's accelerated patch timetable and its rationale

Apple released security updates on Monday for iOS, macOS and Safari that address more than three dozen flaws and move the company to push fixes earlier than in prior cycles. The company told Reuters the change responds directly to concerns that artificial intelligence could shrink “the window between discovery and weaponization to hours,” making faster distribution of patches necessary.

AI tools and credited researchers behind discoveries

Four WebKit defects listed in Apple’s advisory were discovered with the help of AI tools. Apple credited OpenAI Codex Security for three of the defects and credited Anthropic researchers Milad Nasr and Nicholas Carlini — along with the Claude model — for one (CVE-2026-43715). The four WebKit bugs addressed include memory corruption, out-of-bounds write, use-after-free and unspecified crash conditions triggered by maliciously crafted web content.

Named WebKit vulnerabilities and what was fixed

  • CVE-2026-43707 — a memory corruption issue that could result in an unexpected process crash when processing maliciously crafted web content; fixed with improved memory handling.
  • CVE-2026-43716 — an unspecified issue that could result in an unexpected Safari crash when processing maliciously crafted web content; fixed with improved memory handling.
  • CVE-2026-43745 — an out-of-bounds write issue that could result in an unexpected Safari crash when processing maliciously crafted web content; fixed with improved input validation.
  • CVE-2026-43715 — a use-after-free issue that could result in memory corruption when processing maliciously crafted web content; fixed with improved memory management (credited to Milad Nasr, Nicholas Carlini, and Claude).

These four are part of nearly 30 WebKit vulnerabilities Apple patched. Other WebKit fixes called out in the advisory include a use-after-free in WebKit Canvas (CVE-2026-43720) and a vulnerability that could allow a malicious website to process restricted web content outside the sandbox (CVE-2026-43725).

Kernel-level bugs and credited researcher Hyunwoo Kim

Alongside WebKit fixes, Apple remediated three kernel-related bugs. CVE-2026-43722 could be exploited by a malicious app to leak sensitive kernel state; CVE-2026-43724 could be used to cause unexpected system termination or write kernel memory; and CVE-2026-39868 could corrupt kernel memory. Security researcher Hyunwoo Kim, credited with discovering Dirty Frag, is named for reporting CVE-2026-43724 and CVE-2026-43722.

Affected releases and the current exploitation status

The updates are available as iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2 and Safari 26.5.2. Apple’s advisory notes that none of the patched vulnerabilities have been disclosed as actively exploited in the wild.

What this means for technologists, end users, and potential adversaries

  • Technologists and security teams: Expect to prioritize the iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2 releases for rapid deployment; the advisory ties the cadence of these updates to AI-accelerated exploit development.
  • End users and the general public: The fixes are available now in the stated builds; Apple’s statement emphasizes reducing the time between public disclosure and customer availability of updates.
  • Adversaries and threat actors: The advisory gives no indication that any of these specific vulnerabilities were already in active use, but Apple’s public rationale signals an expectation that AI could materially shorten exploit development cycles.

Apple’s June 30 patches package a large set of WebKit fixes alongside kernel hardening and reflect a defensive posture calibrated to AI-driven risk. The company has released the fixes in iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2 and Safari 26.5.2 and says none of the vulnerabilities are known to be under active exploitation. The concrete question the record leaves is whether moving patch releases earlier will keep pace with the accelerated exploit timelines Apple warns AI can enable.

Original story

Artificial IntelligenceEmerging ThreatsIosMacosSecurity PatchesZero-DayAI Discovered FlawsWebkitSafari
Related Intelligence

Continue Reading

Blurred laptop screen on a minimalist desk shows a Microsoft Teams meeting, with a subtle gatekeeper figure in the…

Microsoft Fortifies Teams Against Bot Intrusions

Microsoft is stepping up its game to protect Teams meetings from unwanted bot intrusions by introducing a virtual bouncer that keeps automated accounts at bay. This new defensive measure is a significant boost to Microsoft Teams security.

Analyst 207
Dimly lit server room with rows of computer servers, cables, and softly glowing screens displaying code amidst shadows.

Weak RSA Keys Exposed in Widespread Use

Meet the badkeys project, an open-source service that scans public keys for vulnerabilities, which recently uncovered a surprising pattern of weak RSA keys in widespread use. By analyzing a massive dataset of real-world public keys, the team discovered a substantial number of keys with a suspicious structure, featuring regularly spaced blocks of zero bits and random data.

Analyst 207
Researchers working on a laptop in a clean-room setting surrounded by diagrams and notes.

Researchers Expose Lethal Flaw in AI Model Security

Researchers have uncovered a shocking vulnerability in AI model security, revealing that a simple formatting trick used to separate system instructions from user requests has become a critical weakness. This flaw, known as role confusion, threatens the very foundation of modern AI systems.

Analyst 207
Dimly lit computer laboratory with scattered technology equipment.

Anonymous Researcher Exploits 15 Software Products with Zero-Day Code Dump

A security bombshell has been dropped: an anonymous researcher has publicly shared exploit code for zero-day vulnerabilities in 15 software products, and hackers are already taking advantage of at least two of them. The alarming revelation has sent shockwaves through the cybersecurity community.

Analyst 207