Version RecordIndependent release archive
Menu

Release appearance

iOS 18.7.10 Public

Full article
Public release

Recorded context

About this appearance

Apple released iOS 18.7.10 on August 17, 2026 as build 22H374, seven days after seeding build 22H373 as the release candidate. The advisory lists one hundred twenty-two distinct CVE identifiers across forty-four components, and every entry names the same four devices: iPhone XS, iPhone XS Max, iPhone XR, and the seventh-generation iPad.

Date
Aug 17, 2026
Availability
available
Revision
No
Build
22H374

Release notes

What changed

Original editorial synthesis. Linked references appear with the claims they support and in the source ledger.

Apple released iOS 18.7.10, build 22H374, on August 17, 2026, a security-only update for the legacy iOS 18 train. Its advisory lists 122 distinct CVE identifiers across 44 named components. The same morning, Apple published iOS 26.6.1 on the current train with 29 CVEs across 8 components. The legacy update is more than four times the size of the current one by CVE count and covers five and a half times as many components. No CVE identifier in the legacy document appears under two components: the 122 distinct identifiers and the per-component totals reconcile exactly.

The advisory opens by stating that the update delivers security fixes that were, in Apple's words, "first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas." The current-train advisory published the same day carries the same construction but names only the iOS 27 and iPadOS 27 betas. The legacy advisory names two beta generations where the current-train advisory names one. Fixes that landed in a 26.6 beta earlier in the cycle, and were already shipped to current-train users in iOS 26.6, only reached iOS 18 users on August 17.

Every one of the 97 vulnerability entries in the document carries the identical device sentence: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation. There is no variation anywhere in the file, no component scoped more narrowly or more broadly than any other. Read against iOS 26.6.1, whose entries open at iPhone 11 and iPad 8th generation and later, the two documents drawn on the same day mark the exact boundary of Apple's legacy support. No model is named in both documents. On the base lines the two abut, iPhone XR to iPhone 11 and iPad 7th generation to iPad 8th generation, but the pair is not a complete partition of Apple's hardware: iPhone 8, iPhone 8 Plus, and iPhone X appear in neither, and the current-train document separately covers iPad Air 3rd generation and iPad mini 5th generation, which are contemporaries of the iPad 7th generation rather than successors to it.

The bulk of the work sits in two places. WebKit alone accounts for 38 CVEs, and the four adjacent components, WebKit Canvas, WebKit History, WebKit Process Model, and WebKit Storage, add one each, putting 42 of 122 fixes in the WebKit family, just over a third of the document. Kernel accounts for 18. Model I/O contributes 9, ImageIO 5, and SceneKit 4. Ten of the WebKit credits read OpenAI Codex Security. Apple applies no exploitation language to any entry: the document contains no instance of "actively exploited", "exploited in the wild", or a report of exploitation, so nothing here is described as a response to attacks in progress.

Source ledger

References

Sources are linked to the claims they support. Publication and access dates are shown when available.

  1. Releases - Apple Developer

    Apple Developer · Apple · 2026-07-29 · iOS 18.7.10 (22H374); August 17, 2026

  2. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · iOS 18.7.10 and iPadOS 18.7.10; Released August 17, 2026

  3. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · Full body of the advisory, all 97 vulnerability entry blocks under the heading "iOS 18.7.10 and iPadOS 18.7.10, Released August 17, 2026"; CVE identifiers and component headings counted directly

  4. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · Full body of the advisory under "iOS 26.6.1 and iPadOS 26.6.1, Released August 17, 2026"; 29 distinct CVE identifiers counted for comparison

  5. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · First sentence of the document body, immediately above "About Apple security updates": "This update delivers security fixes that were first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas."

  6. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · First sentence of the document body: "This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas."

  7. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · "Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation", the sole device string in the document, repeated on all 97 vulnerability entries

  8. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · "Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later", used on 20 of 21 entries; the Telephony entry reads "Available for: iPhone 11 and later"

  9. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · WebKit sections (38 CVE entries) plus the WebKit Canvas, WebKit History, WebKit Process Model, and WebKit Storage sections (one CVE entry each); credit lines within the WebKit sections reading "OpenAI Codex Security"

  10. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · Kernel sections, 18 CVE entries with impact lines including "An app may be able to cause unexpected system termination or corrupt kernel memory", "An app may be able to disclose kernel memory", and "A remote attacker may be able to bypass network filters"; Model I/O sections, 9 entries; ImageIO sections, 5 entries; SceneKit sections, 4 entries

  11. About the security content of iOS 18.7.10 and iPadOS 18.7.10

    Apple Support · 2026-08-17T00:00:00Z · Full document text; the standard Apple exploitation phrasings are absent from all 97 vulnerability entries

Release changes

Changed in this release

Features, fixes, removals, and regressions first observed in this release record.

security · fixed

122 CVEs across 44 components in iOS 18.7.10

undocumentedcorroborated

The advisory for iOS 18.7.10 lists 122 distinct CVE identifiers spread over 44 named components. The distinct-identifier count and the sum of per-component counts both equal 122, so no CVE is double listed within the document. The current-train advisory published the same morning covers 29 CVEs across 8 components.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · Full body of the advisory, all 97 vulnerability entry blocks under the heading "iOS 18.7.10 and iPadOS 18.7.10, Released August 17, 2026"; CVE identifiers and component headings counted directly
  2. [2] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · Full body of the advisory under "iOS 26.6.1 and iPadOS 26.6.1, Released August 17, 2026"; 29 distinct CVE identifiers counted for comparison

security · changed

Legacy fixes traced to both the 26.6 and 27 betas

undocumentedcorroborated

The opening sentence of the iOS 18.7.10 advisory states that the update delivers security fixes first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas. The iOS 26.6.1 advisory published the same day uses the same construction but names only the iOS 27 and iPadOS 27 betas. The legacy train therefore draws from two beta generations where the current train draws from one, showing how far back its backport queue reaches.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · First sentence of the document body, immediately above "About Apple security updates": "This update delivers security fixes that were first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas."
  2. [2] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · First sentence of the document body: "This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas."

behavior · changed

Legacy support fixed at four device models

undocumentedcorroborated

All 97 vulnerability entries in the iOS 18.7.10 advisory carry an identical "Available for" line naming iPhone XS, iPhone XS Max, iPhone XR, and iPad 7th generation, with no variation anywhere in the document. The same-day iOS 26.6.1 advisory scopes its entries to iPhone 11 and later and iPad 8th generation and later. The two device lists abut exactly, with no model covered by both documents and none omitted from both.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · "Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation", the sole device string in the document, repeated on all 97 vulnerability entries
  2. [2] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · "Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later", used on 20 of 21 entries; the Telephony entry reads "Available for: iPhone 11 and later"

security · fixed

42 of 122 fixes sit in the WebKit family

undocumentedreported

WebKit is the largest single component in the iOS 18.7.10 advisory with 38 CVEs. WebKit Canvas, WebKit History, WebKit Process Model, and WebKit Storage contribute one each, bringing the WebKit family to 42 of the document's 122 CVEs, just over a third. Ten of the WebKit credits name OpenAI Codex Security.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · WebKit sections (38 CVE entries) plus the WebKit Canvas, WebKit History, WebKit Process Model, and WebKit Storage sections (one CVE entry each); credit lines within the WebKit sections reading "OpenAI Codex Security"

security · fixed

18 kernel-level fixes in iOS 18.7.10

undocumentedreported

The Kernel component accounts for 18 of the 122 CVEs in iOS 18.7.10, the largest concentration outside the WebKit family. Impacts range from unexpected system termination and kernel memory corruption to kernel state disclosure and a network filter bypass. Model I/O follows with 9, ImageIO with 5, and SceneKit with 4.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · Kernel sections, 18 CVE entries with impact lines including "An app may be able to cause unexpected system termination or corrupt kernel memory", "An app may be able to disclose kernel memory", and "A remote attacker may be able to bypass network filters"; Model I/O sections, 9 entries; ImageIO sections, 5 entries; SceneKit sections, 4 entries

security · changed

No exploitation claimed for any iOS 18.7.10 fix

undocumentedreported

A full-text search of the iOS 18.7.10 advisory returns no instance of "actively exploited", "exploited in the wild", "aware of a report", or "extremely sophisticated". Apple attaches no exploitation language to any of the 122 entries, so nothing in this update is documented as a response to attacks in progress.

  1. [1] About the security content of iOS 18.7.10 and iPadOS 18.7.10 · Full document text; the standard Apple exploitation phrasings are absent from all 97 vulnerability entries