Kernel Bug Fixed In iOS 26.4 Allows Full Control Of The System

Updates to the Kernel, including CVE-2026-20698 and CVE-2026-20687, could allow an app to cause unexpected system termination or corrupt the kernel memory, says Adam Boynton, senior enterprise strategy manager at Jamf. “This means an attacker could escalate privileges and gain full control of the system,” he warns

Boynton also highlights the WebKit flaw tracked as CVE-2026-2887, which could result in a cross-site scripting attack, if you visited a maliciously crafted website. “It’s crucial organizations implement this update without delay, as matching the speed of this update to its deployment as closely as possible will boost their security posture.”

00:00

03:12

Read More

The risk will vary depending on people, their organization — and “a whole host of other issues,” says Javvad Malik, lead CISO advisor at KnowBe4. Not every vulnerability will be exploited at scale, he adds.

He advises users to “update their devices to iOS 26.4 as soon as possible.”

iOS 26.4 Bug Fixes

Apple’s iOS 26.4 contains a bug fix for errors when you are typing quickly using the keyboard. Comments about iOS 26.4’s performance on Reddit are largely positive, with one user saying: "It seems that this update has fixed a few bugs for me, swiping over the app list is smooth and some keyboard fixes have been made and the upper part where the clock and date are do not bleed into apps. I use the iPad A16 and it runs nice as of now. I’ll see in a few more days if this keeps up.”

Another user added that the update is “much better” than its predecessor saying: “I hated the glitches, swiping over to the App Library was a little laggy, I hated the keyboard glitches and the other glitch I listed. I’m very happy with this update.”

A separate post claims that Apple “cooked with this one.”

“The keyboard has become much more stable and consistent. Pro motions kicks in much better and my iPhone 16 has been revived almost,” according to another post, with the user adding that the UI “looks slick and clean.”

Yet one user claims iOS 26.4 has created new bugs too. “All of my windows are messed up and the dock hides when it never used to, so I have had to resize everything. There’s a bug in safari when you open a new tab and click into the address bar,” they said.

Other Updates Released Alongside iOS And iPadOS 26.4

Apple has issued a bunch of other updates alongside iOS 26.4. These include macOS Tahoe 26.4, macOS Sequoia 15.7.5 and macOS Sonoma 14.8.5 for Macs and MacBooks.

Meanwhile, tvOS 26.4 provides patches for the Apple TV HD and Apple TV 4K and watchOS 26.4 fixes bugs in the Apple Watch Series 6 and later.

Apple has also released visionOS 26.4 for the Vision Pro headset, Safari 26.4 for macOS Sonoma and macOS Sequoia and Xcode 26.4 for macOS Tahoe 26.2 and later.

Finally, watchOS 8.8.2 is available for the Apple Watch Series 3, Series 4, Series 5, Series 6, Series 7, and SE and watchOS 5.3.10 covers the Apple Watch Series 1, Series 2, Series 3 and Series 4. The two updates contain no published CVE entries, according to Apple, meaning they likely fix bugs only, rather than security flaws.

Stolen Device Protection On By Default In iOS 26.4

The iOS 26.4 update also includes a useful feature for security, with Stolen Device Protection turned on by default.

Stolen Device Protection — which helps prevent your data being accessed if a thief gets hold of your device — has been around for a while. Now it’s on by default in iOS 26.4, you don’t have to worry about your bank details and other important information in the event of a theft.

Stolen Device Protection adds a layer of security in case your iPhone is ever stolen by first recognising the places you go to, says Jake Moore, global cybersecurity advisor at ESET. “It makes it harder for unauthorised access or alteration of sensitive settings making iPhones slightly less appealing to criminals,” he explains.

While the setting is on in iOS 26.4, you can make it extra secure by visiting Settings > Privacy and Security and making a few tweaks. “Make sure you swipe Require Security Delay to ‘Always’ so it works regardless of location, says Moore. “While it's impossible to prevent thefts completely, this feature adds a significant hurdle and buys you time in the first hour of it being stolen which is the most important,” he adds.

Apple’s iOS 26.4 Adds Age Verification For U.K. Users

Apple iOS 26.4 also includes a contentious feature for U.K. users — the addition of age verification to prove people are over 18 in order to access certain services.

Apple has detailed the changes in a support document, which includes a step-by-step guide on how to add your ID.

To confirm you’re an adult, Apple may use details such as information related to your Apple Account, a credit card on file or ID document, the iPhone maker wrote. “Your credit card or ID document aren’t stored unless you choose to save them for other purposes, such as adding a payment method to your account,” Apple added.

Why You Should Update To iOS 26.4 Now

None of the patches in iOS 26.4 appear to have been used in real-life attacks yet. But with so many holes in the iPhone software, it’s important that you update your iPhone now.

Alongside iOS 26.4, Apple has released iOS 18.7.7 for older iPhones, fixing a reduced list of bugs in the iOS software. This is available for the iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation, according to Apple.

But updating to iOS 18 is no longer an option, if your iPhone can run iOS 26, because Apple has stopped allowing you to choose whether to upgrade to the older version of its software.

Apple’s iOS 26.4 is available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later and iPad mini 5th generation and later.

So, what are you waiting for? Go to Settings > General > Software Update and update to iOS 26.4 now.