GoKawiilApple patches iCloud Private Relay IP leak in iOS 26.6.1 update
Apple has silently fixed a flaw in iCloud Private Relay that allowed a user's real IP address to leak under three specific conditions, despite the feature being enabled. Security researchers Talal Haj Bakry and Tommy Mysk, who discovered the issue and built a public tool to test for it, confirmed the fix landed in iOS 26.6.1 (and matching updates for other Apple platforms) though Apple did not disclose it in official release notes. The researchers noted the repair appears limited to Safari and was made without them first reporting it to Apple.
GoKawiil's interpretation of the reporting above, not reported fact.
iCloud Private Relay is a paid privacy feature, so a silent IP leak undermines the core promise subscribers are paying for and raises questions about Apple's transparency in disclosing security fixes. The bug has already triggered a lawsuit from Clarkson Law Firm, the same firm behind a $250 million settlement over Apple Intelligence marketing claims, suggesting continued legal scrutiny of Apple's privacy and AI-related promises.
- iOS 26.6.1 quietly patched an IP leak in iCloud Private Relay affecting Safari.
- Researchers Bakry and Mysk found three scenarios where real IP addresses could leak.
- The vulnerability has already prompted a lawsuit from Clarkson Law Firm against Apple.
Apple iPhone 17 — If you're keeping tabs on iOS privacy fixes like the iCloud Private Relay patch, running a current iPhone means you get those security updates the moment Apple ships them. The iPhone 17 pairs Safari and WebKit with iCloud+ features like Private Relay and Hide My Email for everyday browsing privacy.
See Apple iPhone 17 on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: cnet.com — Jeff Carlson, 2026-08-25
Published there as: “Apple Quietly Fixes iCloud Private Relay Vulnerability in iOS 26.6.1”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.