All iPhone users running iOS 13 or iOS 14 need to update now. Apple has confirmed routine browsing can trigger attacks on outdated iOS versions.
Apple revealed on March 19 that malicious web content can exploit older iOS versions and expose personal data through compromised sites or unsafe links. Apple released security updates on March 11 for both newer and older devices, including iOS 15.8.7 and iOS 16.7.15.
Users on iOS 13 or iOS 14 should upgrade to iOS 15 to receive those protections. Updating iOS closes those gaps and protects against these web-based attacks.
The attacks rely on malicious web content instead of rogue apps or unusual behavior. Visiting a compromised website or clicking a crafted link could trigger WebKit vulnerabilities in Safari.
Apple's latest security advisory comes after two malware campaigns that targeted iPhone users. Coruna is one example of a full iPhone exploit kit that uses web-based attacks to compromise devices.
Newer exploits like DarkSword use similar methods and often share infrastructure across different campaigns. While this latest vulnerability isn't related, it does fall under the same web-based attack umbrella.
How to stay safe from iPhone web attacks
You should update your iPhone to the latest version of iOS that you can, right away. Older devices need to install iOS 15 or later if they can, since that's the minimum version getting current protections. Devices that don't support iOS 15 should no longer be used as browsing devices.
You should enable automatic updates in Settings so security patches install as soon as Apple releases them. Don't postpone updates, even minor ones, since they often include fixes for actively exploited vulnerabilities.
You can use Safari's built-in protections like Safe Browsing to block known malicious domains. However, be careful with unfamiliar links, especially those you get through email, text messages, or social media.
If you're at elevated risk, like journalists or public figures, consider enabling Lockdown Mode. Apple says it can block certain web-based attacks, but it still recommends updating as your main defense.
