Apple has released critical security updates with the latest iOS 26.3, iPadOS 26.3, and macOS Tahoe 26.3 updates, addressing a decade-old zero-day vulnerability, identified as CVE-2026-20700, in the dyld (dynamic linker) component of the operating system. This vulnerability, present since iOS version 1.0, was discovered by Google’s Threat Analysis Group and has been actively exploited in sophisticated, targeted attacks.
The flaw allows attackers with memory write capabilities to execute arbitrary code. When combined with vulnerabilities in WebKit, this can lead to zero-click or one-click device takeovers, posing a significant risk of unauthorized access for espionage or surveillance purposes. These characteristics suggest involvement from commercial spyware vendors akin to those behind infamous spyware like Pegasus and Predator.
The release of iOS 26.3 not only closes this long-standing security gap but also addresses dozens of other vulnerabilities, enhancing the overall security of Apple’s operating systems. Apple strongly advises users to update their devices immediately to mitigate the risk posed by these exploited vulnerabilities. The security update is part of a broader strategy to protect users against potential exploits that could become more widespread with public disclosure.
Updates are widely available and cover multiple Apple platforms, including watchOS 26.3, tvOS 26.3, visionOS 26.3, and Safari 26.3. Users are urged to ensure automatic updates are enabled to protect against potential threats and maintain device security integrity.

Collections

Apple released iOS 26.3, iPadOS 26.3, and macOS Tahoe 26.3 to patch CVE-2026-20700, a zero-day vulnerability in the dyld component that has existed since iOS 1.0. Discovered by Google's Threat Analysis Group, the flaw has been actively exploited in targeted attacks, allowing arbitrary code execution when combined with WebKit vulnerabilities. The exploit enables zero-click or one-click device takeovers for espionage purposes, with characteristics suggesting commercial spyware vendor involvement. Users are strongly advised to update immediately across all Apple platforms including watchOS, tvOS, visionOS, and Safari.

Apple Releases Critical Security Updates for iOS and macOS to Patch Exploited Zero-Day Vulnerabilities