gshc2020.com

Areas of Expertise

Read Full Bio

July 2, 2026

We may earn a commission from links on this page.

Credit: Editorial RF/Getty Images

Key Takeaways

1. Apple released iOS 26.5.2 on Monday, which comes with patches for 29 security flaws.
2. None of the flaws patched are zero-days, but it is still important to update as soon as possible.
3. Many of the flaws relate to how WebKit handles user data, specifically when accessing websites.
4. Apple is changing how it releases security updates due to threats from models like Anthropic's Mythos.

Table of Contents

While the tech world's collective attention is currently fixed on iOS 27, Apple is still churning out updates to iOS 26. While we're not likely to get another feature-filled release in the "26" era, there will always be bugs and security flaws to squash whenever Apple or third-party researchers discover them. Case in point: On Monday, Apple dropped iOS 26.5.2, which includes fixes for 29 security vulnerabilities.

More interesting than what bugs these patches fix, however, is that the company didn't originally intend to release them yet. In fact, iOS 26.5.2 marks a stark change in how Apple rolls out security updates, in large part due to potential threats from new AI models.

iOS 26.5.2 wasn't always meant to be. Apple told Reuters earlier this week that these patches were actually meant for a future version of iOS—perhaps iOS 26.6—but the company is now changing how it handles security updates going forward, specifically due to the security threats of models like Anthropic's Claude Mythos. These models can easily detect security vulnerabilities in software earlier than human researchers, and, as such, Apple feels it necessary to release patches as soon as they're available. Traditionally, the company bundles security patches with its typical software updates, as opposed to other companies that separate security patches from feature updates. But as these new AI models spread, and the risk of bad actors discovering security vulnerabilities grows, Apple will now release new patches much sooner than it normally would.

As such, you should expect to see more updates appear on your Apple devices than in the past. I wouldn't be surprised to see iOS 26.5.3 hit the scene before an iOS 26.6, and Apple may release more "iOS 26" updates than usual before iOS 27 drops this fall. You should always update your devices whenever those updates become available, as the threat from AI security models really is significant.

Here's what iOS 26.5.2 patches

First, the good news: None of these vulnerabilities appears to be a "zero-day." A zero-day is a security flaw that is publicly disclosed or actively exploited before the software developer has a chance to issue a patch. They're especially dangerous, since it gives hackers the advantage: They can attempt to find an exploit—or, worse, take advantage of that exploit—for as long as it takes the developer to issue an update, and for its user base to install it. Luckily, none of these flaws appear to qualify, meaning this isn't a mission-critical situation. Still, any unpatched security flaw is concerning, and now that these are disclosed, it's only a matter of time before someone figures out how to exploit them—especially when assisted by new AI models. As such, it's important to install iOS 26.5.2 as soon as possible.

What do you think so far?

According to Apple's official security release notes, iOS 26.5.2 (and iPadOS 26.5.2) patches 29 security flaws. Many of the flaws have to do with how WebKit, Apple's engine that powers Safari, secures user data. You'll see some flaws that could expose sensitive data if the user processes malicious web content (e.g., if you click a fraudulent link), as well as one vulnerability that could leak sensitive data just by visiting a website, even if that site isn't necessarily malicious. Another patch handles a flaw that would let malicious websites process data outside of the "sandbox," or the secure element that Apple keeps websites in so they don't venture into secure parts of iOS, while another patches a flaw that could steal clipboard data without your knowledge.

You'll find all 29 patches listed below, along with a description, the fix, and the CVE (Common Vulnerabilities and Exposures) number used to track them. Again, none of these flaws has a known active exploit.

1. IOGPUFamily: An app may be able to cause unexpected system termination. A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun

2. Kernel: An app may be able to cause unexpected system termination or write kernel memory. The issue was addressed with improved input sanitization. CVE-2026-43724:

3. Kernel: An app may be able to leak sensitive kernel state. The issue was addressed with improved input sanitization. CVE-2026-43722.

4. Kernel: An app may be able to cause unexpected system termination or corrupt kernel memory. This issue was addressed with improved input validation. CVE-2026-39868.

5. libxslt: Processing maliciously crafted web content may lead to an unexpected process crash. A double free issue was addressed with improved memory management. CVE-2026-43706.

6. libxslt: Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. CVE-2026-43703.

7. Web Extensions: A malicious web extension may be able to cause an unexpected process crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43704.

8. WebKit: Processing maliciously crafted web content may disclose sensitive user information. A cross-origin issue was addressed with improved tracking of security origins. CVE-2026-43700.

9. WebKit: A malicious website may exfiltrate data cross-origin. The issue was addressed with improved checks. CVE-2026-43735.

10. WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43734/CVE-2026-43726/CVE-2026-43709/CVE-2026-43699/CVE-2026-43742.

11. WebKit: Processing maliciously crafted web content may disclose sensitive user information. A path handling issue was addressed with improved validation. CVE-2026-43732.

12. WebKit: Processing maliciously crafted web content may lead to memory corruption. A use-after-free issue was addressed with improved memory management. CVE-2026-43731/CVE-2026-43715.

13. WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43727.

14. WebKit: A malicious website may be able to process restricted web content outside the sandbox. The issue was addressed with improved input validation. CVE-2026-43725.

15. WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. CVE-2026-43663/CVE-2026-39872/CVE-2026-43712.

16. WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue was addressed with improved memory handling. CVE-2026-43716.

17. WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-43676.

18. WebKit: Processing maliciously crafted web content may result in the disclosure of process memory. The issue was addressed with improved memory handling. CVE-2026-43740.

19. WebKit: Visiting a website may leak sensitive data. A permissions issue was addressed with additional restrictions. CVE-2026-43713.

20. WebKit: A malicious website may exfiltrate data cross-origin. The issue was addressed with improved input validation. CVE-2026-43708.

21. WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. A memory corruption issue was addressed with improved memory handling. CVE-2026-43707.

22. WebKit: Processing maliciously crafted web content may lead to memory corruption. A type confusion issue was addressed with improved checks. CVE-2026-43705.

23. WebKit: A malicious website may be able to process restricted web content outside the sandbox. The issue was addressed with improved checks. CVE-2026-43701.

24. WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43745.

25. WebKit Canvas: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43720.

26. WebKit Storage: A malicious website may be able to silently hijack clipboard data. This issue was addressed through improved state management. CVE-2026-43721.

27. WebRTC: Processing maliciously crafted web content may lead to an unexpected process crash. An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28979.

28. WebRTC: Processing maliciously crafted web content may lead to an unexpected Safari crash. A stack overflow was addressed with improved input validation. CVE-2026-43718.

29. WebRTC: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43717/CVE-2026-43746.

How to update to iOS 26.5.2

Installing this security patch is the same as any other iOS update. If you have Automatic Updates enabled, the OS should update on its own in due time. However, you can manually kick-start the process by heading to General > Software Update and following the on-screen instructions. %!s()

Spurs' owners are determined to turn the tide and show they remain a 'big six' club.

That term was coined not just because of on-field success, with those clubs - Spurs, Arsenal, Chelsea, Liverpool, Manchester City and Manchester United - having dominated the upper echelons of the Premier League table over the past 15 years.

It was also because of their income. The big six simply generate a higher amount of revenue than the rest of the Premier League clubs.

That has allowed them to out-spend their rivals, and Tottenham are to invest more than ever before in their first-team squad.

After completing a £52m move for Jan Paul van Hecke from Brighton, they signed Mateus Fernandes for a club-record £85m on Thursday from relegated West Ham. They have also agreed a deal with Newcastle for Sandro Tonali worth up to £100m.

Spurs have finished 17th - one place above the relegation zone - in each of the past two seasons.

There is now a clear desire from Tottenham's owners and club hierarchy to make statement signings. They also want to spend early in the transfer window and decisively.

And new spending rules, higher revenues, owner cash injections, and freeing up more money to spend on wages are enabling the club to make that desire a reality - with the potential for a further £250m to be spent this summer.

Tonali was the top midfield target for local rivals Arsenal but the reigning Premier League champions found the asking price prohibitive, while Spurs also beat off competition from Manchester United for Fernandes.

Spurs were keen to continue with a co-sporting director model and Sebastien Kehl was close to replacing Paratici after leaving Borussia Dortmund but a deal fell through, leaving head coach Roberto de Zerbi with greater power in terms of recruitment.

While Thomas Frank and Igor Tudor had brief spells as manager last season, De Zerbi was appointed on a five-year deal in March and ensured Spurs avoided relegation.

After beating Everton to secure their survival on the final day of the season, the former Brighton boss suggested a need for the club to have a busy transfer window when he said: "We have 10, 11, 12 players good enough to stay."

Fernandes is his fifth signing of the summer so far, after goalkeeper Martin Dubravka plus defenders Marcos Senesi, Andy Robertson and Van Hecke.

The latter is a player De Zerbi knows well as he played under him at Brighton, while the Italian coach is a long-time admirer of compatriot Tonali.

There has been a clear drive from the club's ownership to recruit players with experience and leadership. Although Fernandes is 21, both Lange and De Zerbi highlighted his intelligence and maturity when the club announced his arrival.

Robertson, 32, won all major honours with Liverpool and has just captained Scotland at the World Cup, while Senesi, 29, gained four years of Premier League experience at Bournemouth.

The pursuits of Fernandes and Tonali, both players who have been targeted by Tottenham's big-six rivals, shows that Spurs have increased the squad's wage ceiling, which under Levy had proved prohibitive to attracting elite players.

As part of their new trading model, there is also a remit to improve at generating money from player sales.

That is demonstrated by Brighton's £46m move for defender Luka Vuskovic, a 19-year-old who is yet to play in the Premier League and spent last season on loan at German Bundesliga side Hamburg.

Vuskovic is unlikely to be the last player to leave this summer and further sales will help Spurs to reinvest in other areas of the squad which require improvement, with De Zerbi keen to add reinforcements in attack.

Football finance expert Kieran Maguire

Tottenham can spend significant sums because under the new squad-cost ratio rules (SCR) they are allowed to spend up to 85% of their revenue on player costs - player wages, amortisation and agent fees etc.

In their last set of accounts (2024-25), wages and amortisation was only 61%, and this includes all salaries. Clubs do not separate between playing and non-playing staff, although Uefa says that normally about 75% of total wage costs go towards a club's first team.

In addition, Tottenham's new stadium, which can now host up to 30 non-football events a year at full capacity, is proving to be very beneficial.

At their old White Hart Lane ground, annual matchday revenue was £45m and commercial income - which includes concerts and NFL games - was £73m.

At the new stadium those figures were £126m and £277m, respectively, in 2024-25. The additional money coming into the club allows it to spend more under the SCR regime.

While the club has spent a lot of money this summer to date, transfer fees are amortised over the length of the contract, but limited to five years, so a £240m spend this summer equates to a £48m amortisation fee.

Tottenham's total revenue for 2024-25 was £565m. Under SCR rules they would be able to spend up to £480m a year on their squad. %!s()

A large part of the Trump administration's decision not to renew centers on its desire for major revisions to the Rules of Origin (ROO) requirements for cars. Today, the USMCA dictates that 75 percent of a car must be built using parts that originate from the U.S., Mexico, or Canada to receive preferential tariff treatment. According to a report by Automotive News, the federal government wants to raise that figure to 82 percent, while also adding a clause requiring that 50 percent of a vehicle's parts specifically come from America.

Under the current agreement, parts that comply with the USMCA are not subject to the Trump administration's 25 percent tariff. Vehicles that do comply are subject to a 27.5 percent tariff (the previous 2.5 percent tariff plus the 25 percent Trump tariff) on the percentage of the value of non-U.S. parts they contain.

Representatives for the American automakers have expressed mixed feelings about the USMCA as it currently stands. "North American economic integration enables enormous competitive benefits for the region," the American Automotive Policy Council, which represents Ford, General Motors, and Stellantis, said in a statement on Wednesday. But the group also warned against the disadvantages American automakers face for non-USMCA-compliant cars. "U.S. automakers currently face a disadvantage versus imports from countries whose exports face a flat 15 percent tariff and are not subject to comparable rules of origin. We urge a swift and durable resolution that ensures a level playing field and provides long-term certainty needed for capital-intensive automotive investments."

Leaders from foreign automakers have thrown their weight behind the USMCA's extension, with Autos Drive America—the trade group representing international automakers in the U.S.—releasing a joint statement of support. "The USMCA is a success story for the entire U.S. auto industry, with billions invested in U.S. production and thousands of manufacturing jobs created since the agreement entered into force," the group wrote in its statement. "We urge the leaders of the U.S., Canada, and Mexico to swiftly reach consensus on an extension of USMCA that preserves the existing trilateral partnership, returns to preferential treatment for qualifying goods, and continues the stability and predictability that has helped the industry thrive for the past six years."

Both Canada and Mexico said last month that they wanted to extend the deal, with only the United States serving as a holdout. The refusal from the Trump administration was expected, but comes five years after the president touted the deal as the "most important trade deal ever made by the U.S.A." The next round of discussions is set to take place on July 20 in Mexico City, though talks are likely to drag on for months.

➡️ Skip the lot. Let Car and Driver help you find your next car.

Jack Fitzgerald’s love for cars stems from his as yet unshakable addiction to Formula 1.
After a brief stint as a detailer for a local dealership group in college, he knew he needed a more permanent way to drive all the new cars he couldn’t afford and decided to pursue a career in auto writing. By hounding his college professors at the University of Wisconsin-Milwaukee, he was able to travel Wisconsin seeking out stories in the auto world before landing his dream job at Car and Driver. His new goal is to delay the inevitable demise of his 2010 Volkswagen Golf. %!s()

Frameworks like Lean Six Sigma and business process management (BPM) first gained traction because they promised clarity in the chaos—a structured way to bring order to messy, sprawling operations. Lean Six Sigma emphasized statistical rigor and quality control; BPM created end-to-end maps of how work should flow across departments. Both offered a repeatable way to embed habits of measurement, analysis, and accountability into day-to-day company culture.

But today, those time-tested playbooks are evolving as companies seek to embed AI into established process excellence methodologies. By some estimates, the market for AI-powered process optimization is projected to exceed $113 billion within the next decade. In one study, a full 88% of business leaders anticipated increasing investments into AI-infused process intelligence in the next 12 to 18 months.

Yet without the right foundations, many of those investments may not fully deliver on their potential. Companies that already operate with discipline have an edge. They can channel new tools into proven systems rather than bolting them onto shaky foundations. Organizations with mature process disciplines are also better positioned to translate AI ambition into real outcomes, as they are already accustomed to data-driven decision-making and process discipline—precisely the cultural foundation AI systems need to deliver value.

Simply put: AI can accelerate process excellence, but existing process excellence is what makes AI truly impactful. Technology and process are no longer separate levers, and only organizations that pull them together stand to realize the full value of both.

Download the full report.

This content was produced by Insights, the custom content arm of MIT Technology Review. It was not written by MIT Technology Review’s editorial staff. It was researched, designed, and written by human writers, editors, analysts, and illustrators. This includes the writing of surveys and collection of data for surveys. AI tools that may have been used were limited to secondary production processes that passed thorough human review.

Deep Dive

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more. %!s()

This recipe is the cobbler version of my popular blueberry crisp. It’s based on my peach cobbler recipe, which was arguably the most delicious dessert made in my kitchen last summer. I’ve always loved making fruity crisps, and now I’ve moved on to cobblers. Don’t make me choose a favorite!

The Best Blueberry Cobbler is Gluten-Free

There, I said it! I’m obsessed with this almond flour topping, and genuinely prefer it to standard cobblers made with plain flour. It’s easier to work with than all-purpose flour, and I love how it tastes.

The almond flour lends a subtle almond flavor that complements the blueberries. It’s inherently moist, but develops a lovely golden crust and light crispness around the edges.

Try it, and I think you’ll become a convert like me. Whether you need this recipe to be gluten-free or not, it’s a winner.

How to Make Blueberry Cobbler

You’ll find the full recipe below. Here’s a brief preview of the process and why it works so well:

1. Make the filling and bake it halfway: Mix together the filling ingredients directly in your baking dish to avoid dirtying an extra bowl. Bake the filling for about 20 minutes while you prepare the topping.
2. Make the topping: To maximize the lemon flavor, combine the sugar and lemon zest in a small bowl, then rub the zest into the sugar with your fingers. Combine it with the flour, baking powder and salt. Whisk together the melted butter, yogurt and egg, then pour the wet mixture into the dry mixture, and stir until well combined. It will look crumbly at first, but stir well until it forms a cohesive dough. 
3. Dollop big spoonfuls of topping over the bubbling blueberry filling, and bake until the topping is lightly golden. Serve your cobbler with vanilla ice cream or whipped cream.

With this simple two-step baking process, you’ll achieve a bubbly, condensed blueberry filling with a perfectly golden topping. If you try to bake it all together at once, the topping will turn too golden before the filling is done.

Watch How to Make This Recipe

More Blueberry Delights

If you can’t get enough blueberries, try one of these recipes next:

• Blueberry Almond Crisp
• Blueberry Frozen Yogurt
• Blueberry Scones
• Healthy Blueberry Muffins
• Simple Blueberry Cake

Please let me know how your cobbler turns out in the comments! I love hearing from you.

Print

This blueberry cobbler recipe features bubbly, jammy blueberries underneath a perfectly golden topping. The topping is made of almond flour, which offers amazing flavor and makes the recipe naturally gluten free. Recipe yields about 9 modest servings.

Blueberry filling

• 2 pounds blueberries (about 6 cups or 3 pints), fresh or frozen*
• ¼ cup maple syrup or honey
• 2 tablespoons arrowroot starch or cornstarch
• 2 tablespoons lemon juice
• ¼ teaspoon ground cinnamon

Almond flour topping

• 2 ½ cups (225 grams) blanched almond flour**
• 1 tablespoon baking powder
• ¼ teaspoon fine salt
• 3 tablespoons granulated sugar
• Zest from 1 large lemon (around 1 tablespoon) 
• 5 tablespoons unsalted butter, just melted
• 2 tablespoons plain whole-milk Greek yogurt
• 1 large egg
• Optional: 1 teaspoon turbinado sugar (raw sugar) for sprinkling on top
• Vanilla ice cream or whipped cream, for serving

1. Preheat the oven to 375 degrees Fahrenheit. To make the filling: Rinse and drain the blueberries, then pick through them to remove any stems still attached. In a 9-inch square baking dish, combine the blueberries, maple syrup, starch, lemon juice and cinnamon. Stir until all of the powdered ingredients have disappeared into the mixture. Bake the filling for about 25 minutes, until the mixture is bubbling around all four edges.
2. Meanwhile, prepare the topping: In a mixing bowl, combine the flour, baking powder and salt. Whisk gently until combined, and set it aside. 
3. In a small bowl, combine the sugar and lemon zest. Use your fingers to rub the zest into the sugar (this extracts more flavor from the lemon). Then, pour the sugar into the other dry ingredients and whisk to combine. 
4. In the smaller bowl, combine the melted butter, yogurt and egg, and whisk until evenly combined. Pour the wet mixture into the dry mixture, and stir until well combined. It will look crumbly at first, but stir well until it forms a cohesive dough. 
5. Dollop one large spoonful at a time over the hot filling, using the back of another spoon or your finger to help transfer each dollop. Sprinkle the sugar evenly over the dough. 
6. Bake for 16 to 20 minutes, until the filling is actively bubbling around the edges and the top is lightly golden. Let the cobbler rest for 5 to 10 minutes before serving. Serve with vanilla ice cream, if desired. Leftovers keep well for up to 5 days in the refrigerator—try them the next day with Greek yogurt for breakfast!

Notes

Recipe adapted from my Peach Cobbler with Almond Topping and Blueberry Almond Crisp.

*How to use frozen blueberries: Defrost the blueberries in the refrigerator overnight or at room temperature for about 2 hours (no need to drain off excess juices). Or, while the oven is preheating, place the frozen blueberries in your square baker. Warm them up in the oven, stirring every 10 minutes or so, until they have defrosted to the point that they are cool to the touch but no longer frozen. Then add the maple syrup and other ingredients, and proceed with the recipe as written.

**Almond flour notes: Not all almond flours are created equally. I tested this recipe with Bob’s Red Mill’s super-fine almond flour and Whole Foods 365’s almond flour with great results.

Nutrition

The information shown is an estimate provided by an online nutrition calculator. It should not be considered a substitute for a professional nutritionist’s advice. See our full nutrition disclosure here.

HELLO, MY NAME IS

Kathryne Taylor

I'm a vegetable enthusiast, dog lover, mother and bestselling cookbook author. I've been sharing recipes here since 2010, and I'm always cooking something new in my Kansas City kitchen. Cook with me!