Apple releases security update to patch DarkSword hacking toolkit

Apple released iOS 18.7.7 and iPadOS 18.7.7 on Wednesday to protect older iPhones and iPads against a leaked set of hacking tools. The tech giant stated that the update allows a broader range of devices to “receive important security protections from web attacks called DarkSword.” Wired reported earlier on Wednesday that Apple was preparing to release the security update. The release provides critical security protections for millions of users with unpatched devices who have chosen not to update to the latest operating system, as well as those with older hardware unable to run the newest software. Apple customers who have enabled automatic software updates should receive the new software automatically.

The DarkSword “malicious code” exploits vulnerabilities in iOS 18.4 through 18.7. The “hacking toolkit” can break into Apple devices simply when a user visits a website hosting the exploit, including legitimate websites that have been breached. Once active, the exploits steal sensitive device data—including messages, browser histories, location data, and cryptocurrency—and upload it to a server hosted by the hackers. These tools have already been observed in attacks targeting users in China, Malaysia, Turkey, Saudi Arabia, and Ukraine. Because the tools have now been published online, security researchers warn that any malicious actor can use them to target individuals running older versions of Apple’s mobile software.

While users running Apple’s latest software, iOS 26, were protected weeks ago, many users have actively avoided updating. Some have opted to remain on older software versions to avoid the new “liquid glass” interface, which has drawn user complaints. For users facing elevated risks, Apple noted that its optional Lockdown Mode—a high-security setting designed for at-risk users—also defends against DarkSword attacks. The company told TechCrunch last week that it is unaware of any successful “government spyware attack” against an Apple device running Lockdown Mode.

Why it matters

This update underscores the persistent risk of web-based exploits targeting older software versions, highlighting the importance of security updates even for users who may prefer older interface designs.