Apple fixed first actively exploited zero-day in 2026

Apple released security updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS to fix an actively exploited zero-day (CVE-2026-20700) — a memory corruption bug in the Dynamic Link Editor (dyld) allowing arbitrary code execution — with Google’s Threat Analysis Group reporting the issue and Apple warning it may have been used in highly sophisticated, targeted attacks; the advisory also references prior exploited WebKit and ANGLE flaws and lists affected devices and patched OS versions.