Apple is shifting its long-standing security strategy in a rare move to protect millions of iPhone users who have resisted upgrading to the latest operating system. In response to the proliferation of a sophisticated hacking tool known as DarkSword, the company is “backporting” critical security patches to iOS 18, allowing users to secure their devices without being forced to move to iOS 26.
Six Vulnerabilities, One Website Visit
DarkSword is not a simple bug but a full-chain exploit kit. It strings together six different vulnerabilities across WebKit, Safari, the dynamic loader, and the kernel to achieve a total device compromise. The most alarming aspect of the attack is its delivery method: a user only needs to visit a compromised website or encounter a malicious advertisement in Safari to trigger the chain.

Unlike many iOS attacks that require a user to click a link in a message or approve an installation prompt, DarkSword operates silently. Once triggered, it can lead to mass data theft, granting attackers access to private photos, chat logs, and cryptocurrency wallets.
The exploit chain has been active since at least November 2025. According to the Google Threat Intelligence Group (GTIG), the tool has been adopted by commercial surveillance vendors and suspected state-sponsored actors, including UNC6353, a suspected Russian espionage group. Observed targets include individuals in Ukraine, Malaysia, Turkey, and Saudi Arabia.
GTIG reported these vulnerabilities to Apple in late 2025, and while they were fully patched in the release of iOS 26.3, a significant gap remained for those still running older software.
Technical Context: What is Backporting?
In software development, backporting is the process of taking a fix or feature from a newer version of a program and applying it to an older version. Apple typically requires users to update to the most recent major OS version to receive security patches. By backporting these fixes to iOS 18, Apple is providing a security lifeline to users who cannot or will not upgrade to iOS 26.
A Surprising Pivot in Apple’s Patching Policy
For years, Apple has maintained a “take-it-or-leave-it” approach to security updates. If a vulnerability was found, the solution was almost always to update to the latest hardware-supported version of iOS. However, the sophistication of DarkSword and the volume of exposed devices have forced a change in tactics.
Initially, Apple released iOS/iPadOS 18.7.7 on March 24, but only for a limited set of older hardware, including the iPhone XR, XS, XS Max, and 7th-generation iPads. This left users on newer devices—who had the option to upgrade to iOS 26 but chose not to—stranded on vulnerable 18.x builds.
Apple has since expanded the 18.7.7 update to a wider range of iPhones and iPads. This expansion ensures that users who prefer the look and feel of iOS 18, or those who have disabled automatic updates, are not left exposed to state-level surveillance tools.
Who is at Risk and How to Respond
The DarkSword exploit specifically targets iOS versions 18.4 through 18.7. Users on iOS 26 are already protected. For those remaining on iOS 18, the path to security is straightforward: update to iOS 18.7.7 immediately.
Users with auto-update enabled should receive the patched version of iOS 18 automatically. Those who manage their updates manually should check their settings to ensure they are no longer running a version between 18.4 and 18.7.
Analysis: The Stakes of Software Inertia
This event underscores a growing tension in the mobile ecosystem: the gap between rapid exploit development by state actors and the user’s willingness to update. When a “zero-click” style exploit like DarkSword hits the wild, the traditional “upgrade to the latest OS” mandate becomes a liability for the millions of users who linger on older versions for stability or aesthetic reasons.
By breaking its own rules to provide backported patches, Apple is acknowledging that the threat landscape has evolved. The risk of hundreds of millions of devices remaining vulnerable to commercial spyware is now greater than the company’s desire to push users toward the latest software version.
Quick FAQ
Do I necessitate to click a link to be infected by DarkSword?
No. The exploit can be triggered simply by loading a compromised website or seeing a malicious advertisement in Safari.
Which devices are covered by the iOS 18.7.7 update?
While initially limited to iPhone XS, XS Max, XR, and 7th-gen iPads, Apple has expanded the update to cover more iPhones and iPads running iOS 18.
Is iOS 26 safe from this attack?
Yes, users on iOS 26 were already protected against the DarkSword exploit chain.
Will this rare move by Apple lead to a permanent change in how the company handles security updates for older operating systems?





