Apple’s first exploited zero-day of 2026
iOS 26.3 fixes a bug Apple says was used in an extremely sophisticated attack on specific people. Update your devices.
Apple released iOS 26.3, macOS Tahoe 26.3 and matching updates for its other devices this week. One fix, CVE-2026-20700 in dyld, the component that loads app code, was used in what Apple calls an extremely sophisticated attack against specific targeted individuals. Older devices get fixes in iOS 18.7.5 and older macOS versions.
Attacks like this are aimed at a few people: journalists, officials, executives, activists. But once the fix is public, the bug is easier for others to study and reuse.
- Update iPhones, iPads and Macs now. Settings, General, Software Update.
- Turn on automatic updates so the next one installs overnight.
- Company devices: set a deadline in your device management tool, and block access from devices that miss it.
- If you’re a likely target, turn on Lockdown Mode.