By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
iPhone hacked: Apple patched 507 iOS bugs in 2026, up 51% on 2025
On this page · 7 sections
Short answer: Yes, the iPhone got hacked again, on stage. Researchers at Calif showed a Signal 1-click attack and an iMessage attack against iPhones at Hexacon in Paris on October 16 2026, and the post about it hit 1,107 points on Hacker News. Our count of Apple's own security notes says this is not a one-off: iOS updates in 2026 list 507 unique CVE IDs so far, against 335 in all of 2025. The walled garden is not keeping bugs out. It is keeping you from seeing them.
TL;DR: We pulled every iOS security note Apple published in 2025 and 2026 (40 updates) and counted 507 unique CVE IDs for 2026 through October, up 51% on the 335 for all of 2025. iOS 27 alone shipped with 145 listed fixes, the biggest single iOS patch list in two years. CISA's list of bugs confirmed exploited in the wild has 9 Apple entries added in 2026, behind Microsoft's 40 and Cisco's 19, and level with Fortinet. The fix for you is boring and free: update the day the patch lands, and turn on Lockdown Mode if you are a target.
Key numbers
| What | Number | Source, checked Oct 26 2026 |
|---|---|---|
| Unique CVE IDs in iOS security notes, 2026 to Oct 26 | 507 | Apple security releases |
| Same count, all of 2025 | 335 | Apple security releases |
| CVE IDs listed in the iOS 27 note (Sep 14 2026) | 145 | Apple security releases |
| Apple bugs added to CISA's exploited list in 2026 | 9 | CISA KEV catalog v2026.10.23 |
| Microsoft bugs added to the same list in 2026 | 40 | CISA KEV catalog v2026.10.23 |
| Calif iPhone post on Hacker News | 1,107 points, 721 comments | Calif, "iPhone" |
What Calif actually showed
Calif's post is four demo clips and one line: "Today, we hacked what we'd set out to hack: the iPhone." The demos, shown at Hexacon in Paris on October 16 2026, cover a Signal 1-click attack, an iMessage attack, and a slide titled "APT stands for Apple Persistent Threat".
They say the details will be "released in due time". So nobody outside Calif and, presumably, Apple knows the exact bugs yet. That is normal for responsible disclosure. It is also the whole problem with a closed phone: you find out what was wrong only when the vendor decides to tell you.
One thing we can check. Apple's newest note, for iOS 27.1 on October 23, says "This update has no published CVE entries." Either the Calif chain is fixed quietly, or it is not fixed yet. Apple's page does not say which.
Apple's own notes: the bug count is climbing, not falling
A CVE is a public ID number for one security bug. Apple lists them in a note for every update. We fetched all 40 iOS notes from January 2025 to October 2026 and de-duplicated the IDs per year.
2025: 335 unique IDs. 2026 so far: 507. That is 51% more with more than two months left in the year. The full list, with a link to each note, is in the download below.
The patch lists also keep getting longer. iOS 26.3 in February listed 46 IDs. iOS 26.6 in July listed 97. iOS 27 in September listed 145. Even iOS 18.7.10, a patch for older phones like the iPhone XS, listed 131 in August.
The kind read: Apple and outside researchers are finding more, which is good. The less kind read: a phone sold on "what happens on your iPhone stays on your iPhone" ships hundreds of fixable holes a year, and the number is going up, not down. Our bet is both are true, and only one of them is in the ads.
A caveat on method, so you can check us: some notes cite the same ID twice or reference a WebKit or open-source CVE, so we count each ID once per year. Raw per-note counts are in ios_advisories.csv. The trend holds either way.
Exploited for real: CISA's list
Bug counts measure work. Exploited bugs measure damage. CISA, the US cyber defense agency, keeps a Known Exploited Vulnerabilities catalog: bugs it has evidence attackers used. We pulled version 2026.10.23, 1,756 entries in all.
Apple entries added per year: 23 in 2021, 26 in 2022, 21 in 2023, then 7 in 2024, 9 in 2025 and 9 in 2026 so far. So the confirmed-exploited count fell by about two thirds from the 2022 peak and has sat flat since.
Three of 2026's nine are old bugs added late: CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000, all added on March 5 2026. Translation: attackers were using holes from 2021 and 2023, and the public list caught up years later.
The most recent iPhone one matches Apple's own notes. iOS 26.7.1 on September 28 fixed one bug that Apple said "may have been exploited", and CISA added CVE-2026-86950 the next day.
Follow the money: who wins when the iPhone stays closed
Next to the rest of the industry, Apple looks fine. In 2026 Microsoft has 40 exploited entries, Cisco 19, and Fortinet and Apple 9 each. Google and Linux have 8.
But look at who that low number serves. A fall from 26 to 9 confirmed exploits can mean fewer attacks. It can also mean the attacks got more expensive and quieter, sold to fewer, richer buyers who do not get caught. Nobody has proven the second reading. The pattern of a few high-value chains, demoed at conferences like Hexacon, fits it well.
The winners of a closed iPhone are Apple, which controls the story of every bug, and whoever can pay for a working chain. The losers are the people who cannot read the code, cannot run their own security tools on the phone, and learn about a hole from a two-line note after the fact. Owning your device should mean being able to check it. On an iPhone you mostly cannot.
We made the same argument about Apple's grip on apps in the App Store tax piece, and about patch lag in our 236-day CVE fix count. More on phones in the iOS hub and today's stories in News.
What this means for you
Turn on automatic updates and install every iOS update the day it lands. 2026's exploited Apple bugs were fixed in point releases like 26.3 and 26.7.1, and those only protect phones that install them. If you are a journalist, an activist, an exec or anyone a government might care about, turn on Lockdown Mode in Settings, Privacy and Security. Treat Signal and iMessage links from strangers as untrusted until Calif publishes the details.
If you ship an app or a site, the same rule applies to you: the holes you do not look for are the ones that bite. Our $49 Launch Check runs 26 checks on your landing page and launch setup. If a problem in what we checked turns up later, we keep fixing it at no extra cost until it does what it promises.
Sources
- Calif, "iPhone", October 16 2026
- Hacker News discussion of the Calif post, 1,107 points, checked October 26 2026
- Apple, Apple security releases, and the 40 linked iOS notes, fetched October 26 2026
- CISA, Known Exploited Vulnerabilities catalog, version 2026.10.23, fetched October 26 2026
First published here on tensorust.com on Oct 26, 2026. Related: .
Up next
More on iOS and SwiftApple's 30% App Store toll won't survive AI agents. Its filings knowApple Services keeps 75.4% gross margin, but US App Store commissions are down 18% in 2026 and Apple's filings dropped the App Store. Agents pay at 2.9%.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Shipping an iPhone app?
Get an honest budget and see Apple's cut
Two free calculators: what your app costs to build, and what you keep after the App Store fee.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Explainer · AI, LLMs and agentsClaude Code vs Cursor: what each costs now that SpaceX owns Cursor
- Explainer · iPhone appsGuideline 4.3(a) design spam, explained
- Explainer · Money and the economyWhat is circular financing in AI?
- Explainer · iPhone appsApp stuck in "Waiting for Review": how long is normal, and when to worry
Read next
Free tool: iPhone app cost calculator → Pick an app type and features, get an honest budget range.
- AI · Oct 25, 2026 · 11 min readApple's 30% App Store toll won't survive AI agents. Its filings know
- AI · Oct 26, 2026 · 8 min readFICO score is America's oldest AI. The AI bias panic gives it a pass
- AI · Oct 26, 2026 · 6 min readThe GPU shortage was manufactured. H100 rental prices just proved it