On September 21, 2026, India's CERT-In issued a high-severity alert, providing Apple users with yet another safety issue. Vulnerabilities affecting iOS versions before 26.7 and several other Apple platforms are covered by the notice.

Memory corruption, use-after-free problems, and flaws that might let remote attackers run programs or access private data are some of the faults. On September 14, Apple released iOS 26.7, which fixed a number of security issues, including a significant WebKit memory corruption vulnerability.

CERT In Flags High Severity Apple Vulnerabilities

A wide range of Apple products are covered by CERT In's vulnerability note CIVN 2026 0468. iOS and iPadOS versions before 26.7, macOS versions before their specified patched releases, tvOS, watchOS, visionOS, Safari, and Xcode are among the impacted products. A successful exploitation could lead to arbitrary code execution, privilege escalation, sensitive information disclosure, security restriction bypasses, or denial of service, according to the agency, which assesses the issue as high severity.

The alert covers more than just one Safari problem. Out-of-bounds memory access, integer overflow, use-after-free, type confusion, race conditions, authentication issues, authorisation flaws, and incorrect input validation are only a few of the fundamental vulnerabilities listed by CERT In. It claims that a remote attacker might exploit these problems by submitting a specially crafted request to a susceptible system.

WebKit Memory Corruption Is a Key Concern

A WebKit vulnerability involving maliciously created web content is identified in Apple's own security documentation for iOS 26.7. The problem was resolved by improved memory management and is classified as a use-after-free vulnerability that could lead to memory corruption. It is listed by Apple as CVE 2026 43715.

The same release also fixed another WebKit Canvas bug. According to Apple, carefully constructed web content may produce an unanticipated Safari crash due to a use-after-free situation. CVE 2026 64718 is the tracking number for that vulnerability.

The fact that the susceptible component may interpret online material is crucial information for iPhone users. This indicates that rather than needing a conventional application level assault, the security issue is located in a portion of the software used to handle websites.

Why Crypto Users Should Pay Attention

As phones can store sensitive wallet information, authentication credentials, and other data related to digital assets, crypto users have a special reason to take mobile security seriously.

Nevertheless, CERT-In does not explicitly state that this September 21 alert caused the theft of cryptocurrency wallet keys from Apple Keychain. Instead, according to its evaluation, successful exploitation could reveal private information and perhaps result in data theft or total system breach.

When determining the true risk, this variation is important. Although the official information that is currently accessible raises concerns regarding sensitive data on impacted devices, it does not prove that attackers have actually used these vulnerabilities to extract iPhone crypto keys.

Update your iPhones today!@Apple Finally put passkeys into the secure enclave ONLY! They should not be decrypted outside the enclave. They can, and will, be stolen... https://t.co/33pezNet5t

— Dankrad Feist (@dankrad) September 21, 2026

iOS 26.7 Already Contains the Fix

On September 14, 2026, Apple released iOS 26.7 and iPadOS 26.7. Numerous system components, including WebKit, WebKit Canvas, Safe Browsing, Photos, DeviceCheck, and others, are fixed in the update.

CERT In particularly instructs impacted individuals and organisations to implement Apple's security patches. iOS 26.7 is listed as one of the necessary fixed versions in its September 21 notification.

The best plan of action for anyone using an impacted iPhone is to check Settings, General, Software Update and install the applicable update. Additionally, while an impacted device is still unpatched, cryptocurrency users should refrain from using a phone as the sole security layer for valuables.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. S&P Global to Acquire OpenZeppelin
2. Derive.xyz Bets Big on On-Chain Options Trading
3. CoinEx Shuts Down After Nine Years
4. Bitcoin ETFs Lose $463M, Ethereum ETFs Gain $197M
5. Revolut Shares Customer Data After Fake Government Email

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.