Morocco’s Directorate General of Information Systems Security (DGSSI) issued a bulletin this week warning of critical vulnerabilities affecting several Apple products, rating both the risk and potential impact as critical. The advisory came from the agency’s cyberattack monitoring and response center, which operates under the National Defense Administration.
The bulletin covers iOS and iPadOS versions before 26.6.1 and 18.7.10, along with macOS Tahoe versions before 26.6.2. It warns that attackers could exploit the flaws to run code remotely, access confidential data, escalate their privileges, or bypass security protections built into the affected systems. The DGSSI singled out one vulnerability, tracked as CVE-2026-3783, as liable to active exploitation.
The Moroccan warning followed Apple’s release of iOS 26.6.1 on August 17, an update patching 29 security vulnerabilities across its product line. The same round of fixes reached iPadOS 26.6.1, macOS Tahoe 26.6.2 and visionOS 26.6.1, while Apple also issued iOS 18.7.10 and iPadOS 18.7.10 for older devices unable to run its latest operating systems.
Most of the vulnerabilities involved WebKit, the browser engine behind Safari, where 21 flaws were fixed, nine of them credited to OpenAI’s Codex Security team. The remaining fixes addressed an ImageIO flaw that could allow arbitrary code execution through crafted images, an audio bug capable of leaking sensitive information, and three kernel vulnerabilities. On iOS, Apple also corrected a telephony flaw that let an attacker on the same network bypass IPSec authentication and intercept traffic.
The release marked Apple’s third security update in three weeks, arriving 11 days after an emergency macOS fix for a separate Screen Sharing flaw and weeks ahead of the expected launch of iOS 27. Apple said none of the disclosed vulnerabilities had been confirmed as actively exploited, and it advised users to install the updates via Settings, then General, then Software Update.
