Your iPhone and Mac might have updated overnight. Here’s why

Apple has released an update for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 (currently a MacBook Neo-only version). The update is part of Apple’s background security enhancement feature in its most recent operating systems, formerly called Rapid Security Responses. The update does not appear in Software Update.

According to an Apple support document, the update contains a single fix for a WebKit vulnerability (WebKit is the engine used by Safari and other web-accessing software). The vulnerability involves WebKit’s Same Origin Policy, which is a mechanism that manages how data is used based on the origin of a website. A malicious user could find a way to bypass the WebKit SOP, but the update fixes this problem. The vulnerability has been documented as CVE-2026-20643 in the Common Vulnerabilities and Exposures database.

The update has been labeled iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a) and macOS 26.3.2 (a) by Apple. It appears in Settings/System Settings > Privacy and security > Background security improvements, and you can install it manually here if it hasn’t already been installed. If you chose to automatically install regular software updates, background security enhancements will also be set to install automatically, but you can also change the toggle here.

Adam Boynton of Jamf, a software company specializing in device management and security, released a statement regarding the update: “For organizations, it is crucial to ensure that this update is released immediately, as any delay will leave devices and operations vulnerable. Most importantly, users should configure updates to be released automatically, so that there is no window of opportunity for attackers.”

Background security improvements are updates that Apple releases between its regular update cycle. These are usually security patches that Apple wants to release immediately without waiting weeks or months for a regular software update.