iOS 26.4 Dropped Three Days Ago and Here Is What You Should Do

iOS 26.4 is worth installing for the security patches alone. Apple patched 39 vulnerabilities in this release, including a Stolen Device Protection bypass that let someone with your passcode sidestep biometric locks, a Keychain permissions flaw, and seven WebKit exploits. None were actively exploited in the wild before the patch, but several required nothing more than physical access to your phone.

The complication is that three days in, a handful of bugs have surfaced. A Reminders badge glitch, some home screen stuttering when swiping fast between pages, and a particularly messy age verification problem in the UK. None of these are dealbreakers for most people, but if your iPhone is your primary work device and you run it in Lockdown Mode, read the full breakdown before you tap Install.

The Security Argument Ends the Debate for Most People

I want to be direct about this. Thirty-nine CVEs is a substantial patch list, and some of these vulnerabilities are the kind that should make you uncomfortable. Apple’s security release notes detail a kernel use-after-free bug (CVE-2026-20687) that could enable memory writes, a baseband buffer overflow (CVE-2026-28875), and a Siri flaw that could reveal user information with physical access. The Stolen Device Protection bypass (CVE-2026-28895) is especially worth noting: it meant someone who already had your passcode could skip Face ID for sensitive actions. That defeats the entire purpose of the feature.

Stolen Device Protection is now enabled by default in iOS 26.4, which means every iPhone running this update gets that safety net without digging through settings. If you left it off before because you didn’t know it existed, Apple just made the decision for you. I think that’s the right call, even if it occasionally means waiting through the one-hour security delay when you’re changing passwords away from home.

What Actually Changed Beyond Security

The headliner is Playlist Playground, a beta feature tucked into Apple Music that generates 25-song playlists from text prompts. You type something like “sad songs from the 1990s for a rainy afternoon” and Apple Intelligence builds a playlist. You can iterate on it, swap songs out, rename it, and save it to your library. It works on any iPhone that runs iOS 26.4, not just Apple Intelligence-capable hardware, because the processing happens on Apple’s servers. The catch: it’s US-only at launch, and it requires an Apple Music subscription.

The Music Recognition control in Control Center now works offline. Tap the Shazam-style button, and your iPhone will listen, store the result locally, and show you the match when you reconnect to the internet. That is genuinely useful on flights and in subway tunnels where the old version would just fail silently.

CarPlay picked up two additions. AI chatbots from third parties, including ChatGPT, Claude, and Gemini, now work hands-free through the CarPlay interface. They cannot control your car or your iPhone’s core functions, but they can answer questions and hold a conversation while you drive. There is also a new Ambient Music widget with preset playlists for Chill, Productivity, Sleep, and Wellbeing. If you spend real time in CarPlay, the full breakdown of these changes is worth reading.

Eight new emoji arrived from the Unicode 16.0 standard: a trombone, a treasure chest, a distorted face, a hairy creature (officially a sasquatch), a fight cloud, an orca, a landslide, and a ballet dancer. The wrestlers and bunny-ears-dancers emoji also got new skin tone options.

At a glance: what iOS 26.4 brings versus the risks of updating right now.

The Bugs That Showed Up After Launch

Three days is enough time for the early adopters to find the rough edges. Here is what has surfaced so far.

UK age verification is a mess. iOS 26.4 introduced an OS-level age verification system for users in the United Kingdom, parts of Australia, Brazil, Singapore, and some US states. The system asks users to prove they are over 18 via a credit card scan or photo of a driving license. The problem is that the scanning process fails frequently. Users who ran betas are particularly affected because their accounts get flagged. If you do not have a credit card and your license will not scan, you can end up stuck in a restricted Apple ID state with no obvious way out. This is the worst bug in the release, but it only affects users in those specific regions.

Reminders badge count vanishes. Past-due reminders are not showing a badge on the app icon, even though lock screen notifications and alerts still appear. It is a cosmetic bug, not a data loss issue, but if you rely on that red badge to remember you have overdue tasks, you will miss them until Apple patches it.

Home screen stuttering. Some users are reporting a brief icon fade-in when flicking quickly through home screen pages. It looks like the icons take a fraction of a second to render as you swipe. Again, cosmetic. It does not crash anything or lose data.

Lockdown Mode has a quirk too. The redesigned App Store account panel does not load properly while Lockdown Mode is active. You can still download and update apps, but accessing your account settings requires toggling Lockdown Mode off temporarily.

The Keyboard Fix You Have Been Waiting For

This one deserves its own section because it drove people genuinely nuts. In iOS 26.3, a bug caused characters to appear like they registered during fast typing but then vanish from the text field. You would type a sentence, glance at it, and find missing letters. Apple confirmed the fix in 26.4, and after three days of heavy typing on my own iPhone, I have not seen it resurface. If that keyboard bug was the reason you hesitated on 26.3, this update resolves it.

Battery drain improvements are also part of 26.4. Background processes that were not entering low-power states correctly in 26.3 have been addressed. I am not going to claim dramatic battery life gains because real-world results depend on your apps, your signal strength, and your usage patterns. But the underlying issue, where certain system services and third-party app extensions stayed active longer than intended, has a targeted fix. If your battery health percentage has been dropping faster than expected, give 26.4 a week and compare.

Who Should Wait

If you are in the UK or another region with the new age verification system and you do not have a credit card linked to your Apple ID, wait. The scanning failures are widespread enough that I would not risk getting locked into a restricted account state until Apple pushes a fix.

If you run Lockdown Mode full-time for professional security reasons, know that the App Store account panel bug will require you to briefly disable it. That is not a catastrophic issue, but it is an inconvenience worth knowing about before you commit.

Everyone else should install this update. Thirty-nine security patches is not a “wait and see” situation. The features are nice. The Playlist Playground beta is fun. The offline music recognition is quietly brilliant. But the real reason you should update is that a kernel use-after-free, a baseband buffer overflow, and a Stolen Device Protection bypass are now patched on your device instead of sitting there as open doors.

Before You Tap Install

Check your free storage first. The download size varies wildly by device: most iPhones see 2 to 4.5 GB, but some iPhone 16 Plus models are reporting 12 GB downloads. Apple recommends having double the download size free for the installation process. Head to Settings, then General, then iPhone Storage, and make sure you have room.

Run a backup. iCloud or Finder, does not matter, just make sure one exists from today. Updates rarely go sideways, but when they do, having a fresh backup is the difference between a mild annoyance and a very bad day.

And once the update finishes, take five minutes to check the seven iOS 26.4 settings worth changing immediately. The new Reduce Bright Effects toggle in Accessibility settings is worth finding if the Liquid Glass animations bother your eyes, and the updated Stolen Device Protection defaults are worth understanding even if Apple turned them on for you.