Apple took the unusual step of pushing a “Critical Software” alert directly to some iPhone lock screens, warning owners that outdated versions of iOS were being targeted in real-world cyberattacks.
The alert urged affected users to install the latest available software to protect their devices and personal information. Apple said security researchers had identified web-based attacks aimed at older iOS versions through malicious online content.
An attack could begin when a vulnerable iPhone opens a dangerous link or visits a legitimate website that has been secretly compromised. In some cases, attackers may be able to exploit the browser and operating system before the owner realizes anything unusual has happened.
Apple’s message was not a general notice saying that every iPhone had already been hacked. It was a warning that devices running unpatched software remained exposed to vulnerabilities being used in active attacks.
Why Apple’s Alert Was Unusual
Apple regularly releases security fixes, but it does not normally send prominent critical warnings to the lock screens of broad groups of users.
The alert was reportedly labeled “Critical Software” and told recipients that attacks were targeting outdated iOS software, including the version installed on their device. The stronger presentation suggested that Apple was concerned many owners had postponed available updates despite the active threat.
This notification was different from Apple’s individual threat alerts, which are sent to people believed to have been specifically targeted by mercenary spyware. Those specialized warnings are generally associated with journalists, political figures, activists and others selected because of their identity or work.
The critical software message focused more broadly on devices running vulnerable software. Apple’s official guidance said an outdated iPhone could be exposed through malicious web content and that personal data might be stolen.
What Kind of Attacks Were Targeting iPhones?
The warning followed the discovery of sophisticated web-based exploit systems capable of compromising iPhones through browser vulnerabilities.
One of the most significant was a toolkit researchers called DarkSword. Google’s Threat Intelligence Group said it had observed DarkSword being used since at least November 2025 by multiple commercial surveillance vendors and suspected state-sponsored attackers.
The toolkit combined several security vulnerabilities into a complete attack chain. That meant it could move from compromising the browser to gaining much deeper access to the device rather than exploiting only one isolated weakness.
Researchers observed attacks delivered through compromised websites. A person could visit a page that appeared legitimate while hidden malicious code analyzed the iPhone and attempted to deliver the appropriate exploit.
Google said the campaigns were connected with different groups and objectives, demonstrating that powerful iPhone exploitation tools were spreading beyond a single attacker or surveillance company.
What Attackers Could Potentially Steal
A successful full-device compromise could expose far more than ordinary browsing information.
Depending on the attack and permissions obtained, stolen data could include messages, photographs, contacts, saved credentials, call information, location history and files accessible through the device. Cryptocurrency credentials and other financially valuable information could also be targeted.
The exact information available to attackers would depend on the iOS version, the vulnerabilities used and the malware installed after exploitation.
Apple’s public warning used more cautious language, saying that data on an outdated iPhone “might be at risk of being stolen” after the user clicked a malicious link or visited a compromised website.
Updating Closes Known Security Gaps
Apple had already issued patches for the vulnerabilities covered by its warning. The immediate problem was that many users had not installed them.
A security patch changes the vulnerable part of iOS so that an exploit designed for the older software can no longer operate in the same way. Until that update is installed, the device may remain exposed even though Apple has released a fix.
Apple advises users to open Settings, select General and then choose Software Update. The phone should install the newest version offered for that particular model.
Users should not rely on a version number mentioned in an old article because Apple continues to release new updates. The correct target is the latest version currently offered through the iPhone’s own Software Update screen.
Apple maintains an official list of current releases and supported devices on its security releases page.
Older iPhones May Receive Separate Updates
An iPhone does not necessarily need to support the newest major iOS generation to receive a security fix.
Apple sometimes releases separate updates for older devices that cannot install the latest operating system. Its security-release history includes patches for older branches such as iOS 15 and iOS 16, supporting devices including the iPhone 6s, iPhone 7, iPhone 8 and iPhone X at different points.
Owners of older phones should therefore check Software Update rather than assuming no protection is available.
A device that receives no new software and cannot move to a supported iOS version presents a more difficult security problem. Continuing to use an unsupported phone for banking, business communication, password storage or other sensitive activity can create increasing risk as newly discovered vulnerabilities remain unpatched.
Automatic Updates May Not Install Immediately
Some owners believe their iPhone must already be protected because automatic updates are enabled.
Automatic updates are useful, but installations may be delayed. The phone may wait until it is charging, connected to Wi-Fi and locked. Apple may also roll out an update gradually instead of installing it on every device at the same moment.
Users responding to a critical alert should manually open Software Update and confirm whether an installation is waiting.
Under Automatic Updates, owners can enable both the downloading and installation of iOS updates. Available security-response or system-file options should also remain enabled so urgent protections can be delivered with less delay.
The device should be connected to power, backed up and given sufficient free storage before installation.
The Alert Itself Could Be Imitated by Scammers
A real Apple security warning can create an opportunity for phishing.
Criminals may send texts, emails or pop-up advertisements claiming that an iPhone is infected and asking the user to press a link, call a number, install an app or enter an Apple Account password.
A legitimate software update should be installed through Settings, General and Software Update. Users do not need to enter payment details, purchase security software or grant remote access to someone claiming to be Apple support.
A browser pop-up that says the device has several viruses is not the same as an official iOS notification. The safest response is to close the page and check for updates directly through Settings.
Owners who receive a suspicious message can review Apple’s guidance on recognizing social-engineering and phishing attempts through Apple Support.
Lockdown Mode Adds Protection for High-Risk Users
Apple’s Lockdown Mode is an optional security feature designed for people who may face highly sophisticated targeted attacks.
When enabled, it restricts certain message attachments, web technologies, invitations, configuration profiles and wired connections. These limitations reduce the number of features an advanced exploit can use to enter or control the device.
Lockdown Mode is not necessary for most iPhone owners and can make some websites or communication features work differently. Apple primarily recommends it for people who believe they could be targeted by mercenary spyware because of who they are or what they do.
It is also not a replacement for updates. A device should still run the latest available software even when Lockdown Mode is active.
Details about enabling the feature are available through Apple’s official Lockdown Mode guide.
Restarting the Phone Is Not a Permanent Fix
Restarting an iPhone can sometimes interrupt malware that does not persist after a reboot, but it does not patch the vulnerability that allowed the attack.
A vulnerable phone could be compromised again when it revisits malicious content. Updating iOS is necessary to close known security flaws.
Users who believe their device may have been targeted should update it, change important passwords from a trusted device and review Apple Account activity. They should also examine unfamiliar devices connected to the account and confirm that two-factor authentication is enabled.
Someone who received a personalized Apple threat notification should follow the instructions provided by Apple and consider seeking professional cybersecurity assistance. Apple explains how to confirm the authenticity of those notices on its threat-notification support page.
Businesses Should Treat Delayed Updates as a Security Risk
The warning also matters to companies whose employees use iPhones to access email, customer records, cloud documents or workplace systems.
One compromised phone may expose authentication codes, saved sessions, business messages or credentials that allow attackers to reach other services.
Organizations should maintain an inventory of company-connected devices and require a minimum supported iOS version. Mobile-device-management systems can help administrators identify phones that have missed required updates.
Employees should also be trained to report unexpected security alerts instead of dismissing them or following links in unverified messages.
What iPhone Owners Should Do Now
Every iPhone owner should open Settings, select General and check Software Update.
The newest update offered for the device should be downloaded and installed. The same check should be performed on iPads because related vulnerabilities and patches often affect iPadOS as well.
Owners should enable automatic updates, avoid unexpected links, use a strong device passcode and maintain two-factor authentication on their Apple Account.
A person who received the warning should not panic. The alert did not mean Apple had confirmed that the individual phone was already compromised. It meant the installed software was old enough to remain vulnerable to attacks that researchers had observed in use.
The essential response is simple: update through the official Settings app rather than through a link in a message or website.
Apple’s rare critical alert showed that postponing software updates is no longer merely a matter of missing new features. When attackers are actively exploiting browser and operating-system vulnerabilities, delaying a patch can leave personal, financial and business data exposed.
