Apple to Issue Rare iOS 18 Software Update for DarkSword Exploit

Apple on Wednesday will issue software updates to devices still running iOS 18 to protect them from an exploit called DarkSword, which can silently take over an iPhone if it visits a website infected with the malicious code.

Devices on iOS 26 are already protected against DarkSword, but in a surprising move for Apple, its latest critical update is designed to specifically protect vulnerable iOS 18 users who have consciously decided not to update to iOS 26, even though their iPhone model supports it. Some users may be hesitant to upgrade to ‌iOS 26‌ because of the Liquid Glass design overhaul that makes major changes to the iPhone interface.

"Tomorrow we are enabling the availability of an iOS 18 update for more devices so users with auto-update enabled can automatically receive important security protections," an Apple spokesperson told Wired. "We encourage all users with supported devices to update to iOS 26 to receive our most advanced protections."

iPhone users can install the updates by opening up the Settings app, going to General, and selecting the Software Update option. Those with automatic updates turned on will see the new software installed automatically.

It's the second time in the last few weeks that Apple has pushed a critical update to iPhones running out-of-date software. On March 11, Apple issued a patch to protect users from a different iOS hacking toolkit known as Coruna. The patch was for older devices that can't run iOS 26. Apple recommended that everyone else update to the latest OS version that their device supports.

The practice of protecting an older operating system version is known in the cybersecurity industry as "backporting," but it's not something that Apple typically does if a newer, compatible version of iOS has the same protections already baked in.

According to Google, DarkSword has been used by various hacker groups to break into the iPhones of users in Malaysia, Saudi Arabia, Turkey, and Ukraine. Last week, the exploit kit was posted to open source code repository GitHub, making it even more likely to be used by bad actors.