Apple's updated operating systems have left beta with a substantial security payload: iOS 27 addresses 122 vulnerabilities, and macOS 27 fixes more than 200, with some fixes backported to earlier supported releases. The vulnerabilities span memory-corruption bugs, privilege escalation, kernel memory access and remote code execution — the classes that matter most on a platform where the attack surface runs from the browser to the kernel. The notable detail in the release documentation is attribution: several of the fixes are credited to artificial intelligence systems, including Anthropic's Claude and OpenAI's Codex Security. That is a concrete data point for the debate framed elsewhere in today's digest by China's intelligence chief, who described vulnerability industrialisation as the defining phase of cyber operations; here the same capability is being credited on the defensive side of the ledger, in a shipping consumer release. Beyond the patch counts, Apple has strengthened enterprise authentication, added new executable code controls on Macs and retired its legacy update-management mechanism in favour of declarative management, a change with migration consequences for organisations running fleets through the older tooling and one that administrators should schedule rather than discover. One feature announced in the betas has not shipped: an ambitious AI agent that would detect compromised passwords and change them automatically has been put on hold, which is worth noting given that automated credential remediation is precisely what the token-theft and credential-harvesting stories elsewhere in this digest argue for. For enterprises, the practical task is to sequence a patch cycle that is one of the largest of the year while confirming that declarative management is in place before the legacy path is removed.

• Source article