Reprinted from TidBITS by permission; reuse governed by Creative Commons
license BY-NC-ND 3.0. TidBITS has offered years of thoughtful commentary
on Apple and Internet topics. For free email subscriptions and access to the
entire TidBITS archive, visit http://www.tidbits.com/


       Apple Updates Older Operating Systems with OS 26 Security Fixes

   Adam Engst

   Along with the various OS 26 releases that appeared yesterday, Apple
   rolled out a series of updates to older versions of its operating
   systems and Safari to integrate the applicable security fixes and catch
   up with the zero-day exploit from last month. The updates include:
     * [1]iOS 18.7 and iPadOS 18.7: Fixes for 11 vulnerabilities affecting
       all iPhones and iPads capable of running iOS 18. This update is
       available to many devices that can also upgrade to iOS 26 and
       iPadOS 26, but fortunately, Apple is prioritizing 18.7 over 26.0
       for now. If you want to upgrade to iOS 26, you may need to scroll
       down to find the option.
     * [2]iOS 16.7.12 and iPadOS 16.7.12:One vulnerability fixed for the
       iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro
       9.7-inch, and iPad Pro 12.9-inch (1st generation). This update
       hardens older devices against the zero-day exploit that Apple
       recently patched for newer devices (see '[3]Apple Updates Block
       Zero-Day Malicious Image Exploit,' 20 August 2025).
     * [4]iOS 15.8.5 and iPadOS 15.8.5: One vulnerability fixed for the
       iPhone 6s, iPhone 7, iPhone SE (1st generation), iPad Air 2, iPad
       mini (4th generation), and iPod touch (7th generation). This update
       provides the same fix for the just-described exploit for even older
       iPhones and iPads.
     * [5]macOS Sequoia 15.7:Fixes for 34 vulnerabilities, all also
       present in macOS 26 Tahoe.
     * [6]macOS Sonoma 14.8:Fixes for 38 vulnerabilities, all but one of
       which are either in Tahoe or Sequoia. There is one LaunchServices
       vulnerability (CVE-2025-43231) unique to Sonoma, which is just a
       curiosity.
     * [7]Safari 26:Fixes for seven vulnerabilities in Safari for those
       using it in Sequoia and Sonoma.

   I recommend installing these updates soon, but not urgently. Even with
   the zero-day fixes, unless you're using an old iPhone and you might be
   targeted by a hostile government, there's no need to panic-update.

   Overall, there's nothing particularly unusual here. Apple is diligent
   about providing security fixes for the two previous versions of macOS
   and at least one previous version of iOS and iPadOS. It's noteworthy
   that the company decided to fix the malicious ImageIO exploit all the
   way back to iOS/iPadOS 15 to prevent mercenary spyware from targeting
   users with those devices.

References

   Visible links
   1. https://support.apple.com/en-us/125109
   2. https://support.apple.com/en-us/125141
   3. https://tidbits.com/2025/08/20/apple-updates-block-zero-day-malicious-image-exploit/
   4. https://support.apple.com/en-us/125142
   5. https://support.apple.com/en-us/125111
   6. https://support.apple.com/en-us/125112
   7. https://support.apple.com/en-us/125113

   Hidden links:
   8. https://tidbits.com/uploads/2025/09/iOS-18.7-scaled.jpg

.