Security updates aren’t as flashy or fun as feature updates, but they’re just as important—if not more—to install. They include patches for vulnerabilities in your device’s OS that could leave you open to hacking. By patching these weak points as quickly as possible, you reduce the risk to your device and its data.
Traditionally, Apple has largely kept its security updates tied to its general software releases, both big and small. Rather than release iOS 26 and a subsequent security patch, Apple just couples the two. Even if you don’t (or can’t) update to the latest iOS, Apple will add the most important patches to new updates of older iOS versions (e.g. iOS 18.7.6, or iOS 15.8.7). But the company has toyed with individual security releases in recent years, especially for particularly timely patches. They started with Rapid Security Responses, which were updates that were specifically labeled as such, like iOS Security Response 16.4.1 (a). I thought this was a great idea, especially as other platforms, like Android and Windows, already do this for their users.
While it seemed like a good idea, Apple hasn’t released one of these in a while. Instead, the company has largely gone back to releasing security updates alongside typical software updates, whether or not it had any new features to include in said update. Now, it seems, the company is trying out a new type of security update—one that’s rather hidden, at that.
Apple’s Background Security Improvements are a new type of security update
Initially announced with iOS 26.1, iPadOS 26.1, and macOS 26.1, Apple is now rolling out “Background Security Improvements.” According to the company, these are “lightweight security releases” for things like Safari, WebKit (the framework Safari is built on), and other system libraries. Like the Rapid Security Responses, the idea is to issue smaller patches in between software updates. That way, Apple doesn’t have to release iOS 26.3.2 in order to patch Safari; you can stay on iOS 26.3.1, and still update Safari with the proper patch.
In fact, this feature just had its first update this week. On Tuesday, Apple pushed version 26.3.1 (a) for iOS, iPad, and macOS. (There’s also a macOS 26.3.2 (a) for MacBook Neos running macOS 26.3.2). This update patches a WebKit flaw that let bad actors bypass Same Origin Policy if you clicked on malicious web content. Same Origin Policy typically prevents malicious sites from accessing other sites you might have open. For example, if you open a malicious site, Same Origin Policy should stop it from accessing your Gmail inbox open in another tab. But this flaw gave bad actors a way around that.
What do you think so far?
This update is available to all Apple devices running the latest versions of Apple’s OSes, but you won’t find it if you check your Software Update settings. That’s not because it’s still rolling out; rather, you need to make sure Background Security Improvements is enabled in order to open up these new security updates.
How to enable Background Security Improvements
On your Apple device, open Settings (System Settings on macOS), then go to Privacy & Security. Here, scroll down to the bottom of the page, then choose Background Security Improvements. Here, ensure that “Automatically Install” is turned on. If so, the update should install on its own, but there’s no telling when it’ll do so.
You can also install the update manually. Below this toggle, you’ll see the latest Background Security Improvements update. Choose “Install,” enter your passcode or password, and your device will begin downloading the update. When it’s ready, you can hit “Restart & Install.”
