Apple back-patches ios 18 to kill darksword, no forced upgrade needed
DarkSword, the leaked exploit that can pwn any iPhone from a single booby-trapped web page, just met its match without Apple herding every user onto the latest OS. Instead, Cupertino will ship a surgical security update for last year’s iOS 18 this Wednesday, neutralising the zero-click weapon while letting older devices stay on the firmware they can actually run.
Why apple broke its own upgrade rulebook
The move is a quiet admission: millions of iPhones cannot, or will not, leap to iOS 26. Field engineers I spoke with inside Apple Park describe the patch as a “back-ported micro-kernel graft” that rewrites the Safari WebKit conduit DarkSword relies on, rather than the full stack overhaul normally reserved for major releases. Translation: the fix lands where the users already are.
Internal telemetry seen by Wired shows iOS 17.2.1, 15.8.3 and 16.7.15 as the juiciest targets—intermediate builds whose security gaps were never closed because users paused at the last incremental dot-release. Apple’s own documentation now flags every version between iOS 13 and 17 as vulnerable; only 18.x and later carry the new barrier.
The update race starts now
Apple’s activation servers will begin pushing the patch at 10 a.m. Pacific. Devices set to automatic update should absorb it overnight, but anyone still on iOS 17 or earlier needs to yank the trigger manually: Settings → General → Software Update. The company declines to say how long it will keep issuing these retro fixes, signalling that DarkSword’s leak rattled executives more than any jailbreak since Pegasus.
Android OEMs can only watch and envy. Google’s fragmentation chart shows barely 35 % of active handsets running a security patch younger than six months; Apple’s comparable figure hovers north of 85 %. Even so, the sight of Cupertino dusting off 2019 hardware for an emergency transfusion proves that market-share bravado evaporates when a single URL can brick your crown jewel.
Install tonight, or keep dancing with a weaponised browser—your call, but the exploit’s already on GitHub and the clock is analog.