Version RecordIndependent release archive
Menu

Release appearance

iOS 26.6.1 Public

Full article
Public release

Recorded context

About this appearance

Apple released iOS 26.6.1 to the public on August 17, 2026 as build 23G83, seven days after seeding build 23G82 as the release candidate. The update is security-only, and Apple's advisory lists twenty-nine distinct CVE identifiers across eight components.

Date
Aug 17, 2026
Availability
available
Revision
No
Build
23G83

Release notes

What changed

Original editorial synthesis. Linked references appear with the claims they support and in the source ledger.

iOS 26.6.1 reached public release on August 17, 2026 as build 23G83, listed by Apple alongside iPadOS 26.6.1 on the same day. It is a security release. The supporting document, Apple advisory 148282, carries 21 vulnerability entries followed by an Additional recognition section that thanks three researchers without assigning CVEs. It documents only security content, and Apple published no accompanying feature notes for the build.

The advisory contains 21 entries covering 29 distinct CVE identifiers across eight component headings: Audio, ImageIO, IOGPUFamily, Kernel, Telephony, WebKit, WebKit History, and WebKit Storage. The distribution is heavily weighted toward the browser engine. WebKit alone accounts for 19 of the 29 identifiers, and WebKit History and WebKit Storage contribute one each, putting 21 of 29 fixes in WebKit and its adjacent layers. Kernel carries three, ImageIO two, and Audio, IOGPUFamily, and Telephony one apiece.

Nine of the WebKit credit lines name OpenAI Codex Security. Eight of the nine credit it as the sole finder, attributed to Amy Burnett, and the ninth, CVE-2026-64784, shares credit with Janggoon Lee of Out of Bounds. All nine fall under the plain WebKit heading rather than under WebKit History or WebKit Storage. That is nine of the 19 identifiers under the plain WebKit heading, eight of them credited to that group alone. One entry is scoped more narrowly than the rest: the Telephony fix, CVE-2026-65329, carries an availability line reading only "iPhone 11 and later" where the other 20 entries also enumerate iPad models. Its impact line describes an attacker in a privileged network position bypassing IPSec authentication and intercepting network traffic, and the fix is described as an authentication issue addressed with improved state management. Apple credits it to Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum.

The advisory opens with a sentence about where the fixes came from: "This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas." By Apple's account these fixes reached users through the unreleased next major train before they reached the shipping 26 train. The build number also moved between candidate and ship. Apple seeded 23G82 as a candidate on August 10, and the version that went public seven days later is 23G83, one increment higher. Apple has published no explanation for the respin, and none of the 21 entries contains any reference to exploitation.

Source ledger

References

Sources are linked to the claims they support. Publication and access dates are shown when available.

  1. Releases - Apple Developer

    Apple Developer · Apple · 2026-07-29 · iOS 26.6.1 (23G83); August 17, 2026

  2. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · iOS 26.6.1 and iPadOS 26.6.1; Released August 17, 2026

  3. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · Section heading "iOS 26.6.1 and iPadOS 26.6.1", line "Released August 17, 2026", followed by all 21 component entries through the end of the document

  4. Releases - Apple Developer

    Apple Developer · Apple · 2026-07-29 · Releases list, entry "iOS 26.6.1 (23G83)" dated August 17, 2026

  5. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · WebKit, WebKit History, and WebKit Storage entries, counted against the Audio, ImageIO, IOGPUFamily, Kernel, and Telephony entries in the same document

  6. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · WebKit section, credit lines for CVE-2026-64780, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65337, CVE-2026-65338

  7. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · Telephony section: "Available for: iPhone 11 and later", Impact, Description, and CVE-2026-65329 credit line

  8. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · Opening paragraph, first sentence, immediately above the "About Apple security updates" heading

  9. Apple preps beta security updates for iOS 18, iOS 26, and macOS 26

    AppleInsider · 2026-08-10T00:00:00Z · Release list in the article body: "iOS 26.6.1 (23G82)" and "iPadOS 26.6.1 (23G82)"

  10. About the security content of iOS 26.6.1 and iPadOS 26.6.1

    Apple Support · 2026-08-17T00:00:00Z · Full document text, searched for exploitation language with no matches

Release changes

Changed in this release

Features, fixes, removals, and regressions first observed in this release record.

security · fixed

Security-only release with 29 CVEs across eight components

undocumentedcorroborated

iOS 26.6.1 (23G83) shipped on August 17, 2026 carrying 21 advisory entries that cover 29 distinct CVE identifiers across Audio, ImageIO, IOGPUFamily, Kernel, Telephony, WebKit, WebKit History, and WebKit Storage, with no feature or interface change documented by Apple.

  1. [1] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · Section heading "iOS 26.6.1 and iPadOS 26.6.1", line "Released August 17, 2026", followed by all 21 component entries through the end of the document
  2. [2] Releases - Apple Developer · Releases list, entry "iOS 26.6.1 (23G83)" dated August 17, 2026

security · fixed

21 of 29 fixes land in WebKit and its adjacent components

undocumentedreported

WebKit accounts for 19 of the 29 CVE identifiers in the advisory, with WebKit History and WebKit Storage adding one each, so 21 of 29 fixes sit in the browser engine and its adjacent layers; Kernel carries three, ImageIO two, and Audio, IOGPUFamily, and Telephony one each.

  1. [1] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · WebKit, WebKit History, and WebKit Storage entries, counted against the Audio, ImageIO, IOGPUFamily, Kernel, and Telephony entries in the same document

security · fixed

Nine WebKit credits name OpenAI Codex Security

undocumentedreported

Exactly nine credit lines in the advisory name OpenAI Codex Security, all of them under the WebKit heading: CVE-2026-64780, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65337, and CVE-2026-65338. Eight credit it alone, attributed to Amy Burnett, and CVE-2026-64784 shares credit with Janggoon Lee of Out of Bounds.

  1. [1] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · WebKit section, credit lines for CVE-2026-64780, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65337, CVE-2026-65338

security · fixed

iPhone-only Telephony fix for an IPSec authentication bypass

undocumentedreported

CVE-2026-65329 in Telephony is the one entry scoped to "iPhone 11 and later" with no iPad models listed. Apple describes the impact as an attacker in a privileged network position being able to bypass IPSec authentication and intercept network traffic, and the fix as an authentication issue addressed with improved state management. Credited to Bedran Karakoc, Tobias Funke, Jacopo Clark, and Katharina Kohls of Ruhr University Bochum.

  1. [1] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · Telephony section: "Available for: iPhone 11 and later", Impact, Description, and CVE-2026-65329 credit line

behavior · introduced

Advisory states the fixes reached the iOS 27 betas first

undocumentedreported

The advisory opens with the sentence "This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas." Apple is stating that these patches reached the unreleased next major train before the current shipping one, making 26.6.1 the backport rather than the origin.

  1. [1] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · Opening paragraph, first sentence, immediately above the "About Apple security updates" heading

behavior · changed

Shipping build is one increment above the August 10 candidate

undocumentedcorroborated

Apple seeded iOS 26.6.1 as build 23G82 on August 10, 2026 and shipped 23G83 to the public on August 17, one build increment higher. Apple has published no statement explaining the change, and the advisory contains no reference to exploitation.

  1. [1] Releases - Apple Developer · Releases list, entry "iOS 26.6.1 (23G83)" dated August 17, 2026
  2. [2] Apple preps beta security updates for iOS 18, iOS 26, and macOS 26 · Release list in the article body: "iOS 26.6.1 (23G82)" and "iPadOS 26.6.1 (23G82)"
  3. [3] About the security content of iOS 26.6.1 and iPadOS 26.6.1 · Full document text, searched for exploitation language with no matches