26.5.2 Updates Squash Vulnerabilities in macOS, iOS, iPadOS, and Safari
In the ongoing effort to squash security-related bugs before they can be exploited, Apple has released macOS 26.5.2 Tahoe, iOS 26.5.2 and iPadOS 26.5.2, and Safari 26.5.2 for macOS 15 Sequoia and macOS 14 Sonoma. The security-only updates focus on WebKit and related technologies, providing 23 fixes; the macOS, iOS, and iPadOS updates also address 6 additional vulnerabilities, including several in the kernel. Apple doesn’t say that any have been exploited in the wild.
The strangest aspect of these updates is that the release notes for each open with a statement about current beta releases:
This update delivers security fixes that were first made available in the macOS Tahoe 26.6 beta. This document describes the security content of macOS Tahoe 26.5.2.
This update delivers security fixes that were first made available in the iOS 26.6 and iPadOS 26.6 betas. This document describes the security content of iOS 26.5.2 and iPadOS 26.5.2.
This update delivers security fixes that were first made available in the macOS Tahoe 26.6 beta. This document describes the security content of Safari 26.5.2.
I don’t know what, if anything, to make of the first sentence in each of those introductions, but I’m not aware of Apple using it before. Normally, security release notes start with the “This document describes” line.
Beyond the Kremlinology of the wording change, the security fixes seem sufficiently serious that I recommend updating your Macs, iPhones, and iPads soon. The new versions seem to be working fine for me.
Evidently they had built these security features into the OS 26.6 betas already, but then presumably decided they were important and urgent enough to read them back onto OS 26.5 immediately, rather than waiting for OS 26.6 to go final. Similar, perhaps, to those medical trials where the drug being tested turns out to be so valuable that they call off the trial early and just give it to everyone…
Sounds plausible, though I would have expected this to happen all the time.
Here’s some detail on what was changed in 26.5.2 Tahoe.
And here for iOS.