iOS Release History: Security Features From iOS 14 to iOS 26

Apple shipped six major iPhone releases between September 2020 and September 2025: iOS 14, 15, 16, 17, 18 and then iOS 26, which skipped the numbers 19 to 25 when Apple gave every platform the same version number. Each one moved a security or privacy control into the default experience: App Tracking Transparency (iOS 14.5), iCloud Private Relay (iOS 15), Lockdown Mode and passkeys (iOS 16), Stolen Device Protection (iOS 17.3), the Passwords app (iOS 18), and Background Security Improvements plus hardware memory tagging support (iOS 26).

As of 23 October 2026, Apple's security releases page lists iOS 27.0.1 as the current version, iOS 26.7.1 as the latest update for iPhone 11 and later on the previous line, and still lists recent fixes for three older lines: iOS 18.7.10 for iPhone XS, XS Max and XR (17 August 2026), iOS 16.7.16 for iPhone 8 and X, and iOS 15.8.8 for iPhone 6s, 7 and the first iPhone SE (both 11 May 2026). Those older lines get selected fixes, not everything the current release gets, so the practical rule is simple: the phone is fully protected only on the newest version it can run, and only if that version still appears on Apple's page.

Key takeaways

• Version numbers changed in 2025. iOS 18 was followed by iOS 26, announced on 9 June 2025 alongside iPadOS 26, macOS Tahoe 26, watchOS 26 and tvOS 26. There is no iOS 19 to 25.
• There are now four ways a fix reaches an iPhone: a major release each September, point releases (26.1, 26.2), the small bug fix point releases (26.0.1), and since iOS 26.1, Background Security Improvements, which carry WebKit and system library fixes between updates and show up as a letter suffix such as 26.3.1 (a). They take over the role Rapid Security Responses played from iOS 16.
• Device floors moved four times. iOS 14 and 15 ran on iPhone 6s and later, iOS 16 needed iPhone 8, iOS 17 and 18 needed iPhone XS or XR, and iOS 26 and 27 need iPhone 11 or later.
• Older lines get selected fixes for years, not all fixes. iOS 15.8.8 shipped on 11 May 2026 for phones that stopped at iOS 15 in 2022, but Apple's own notes show many fixes land only on the current major version.
• The phrase to search for is "may have been exploited". Apple's release notes flag in the wild exploitation with "Apple is aware of a report that this issue may have been exploited" or "actively exploited". Those updates are the ones to install the same day.
• Lockdown Mode and Stolen Device Protection are opt in hardening. Lockdown Mode (iOS 16 and later) cuts attack surface for people who may be targeted; Stolen Device Protection (iOS 17.3 and later) puts biometric checks and a one hour delay in front of account changes when the phone is away from familiar places.
• The EU changed the app supply chain on iPhone. Users in the EU can install notarized apps from alternative app marketplaces and from approved developer websites. Notarization is a baseline review, not full App Review, which moves more of the trust decision to the marketplace and the developer.

This post goes one level deeper than our other release history and Apple posts. For the same story on the other big phone platform, see the Android release history from Android 10 to 16. For the Mac side of Apple's releases, see the macOS release history from Big Sur to the current release. For what protects data at rest on the phone itself, see Apple data protection classes and the Secure Enclave, and for the cloud side, what Apple Advanced Data Protection covers and what it does not.

iOS versions from 14 to 26: dates, devices and patch status

Every date below comes from Apple's own pages, and the security architecture behind these features is documented in the Apple Platform Security guide (the edition online in October 2026 is dated August 2026): the security releases index and its archives for release dates and supported devices, and Apple Newsroom for the feature announcements. Release dates are the day the security content note says the version was released, which for a September release is the public launch, not the June preview.

Timeline table

Two lines need a note. iOS 14 and iOS 17 have no "last fix" of their own because every iPhone that ran them could move to the next version: iOS 15 kept the iOS 14 device list, and iOS 18 kept the iOS 17 list. Apple stops listing a line once every device on it can upgrade, so an iPhone 6s owner was expected to move from 14 to 15, and an iPhone XR owner from 17 to 18.

Why the number jumped from iOS 18 to iOS 26

At WWDC on 9 June 2025, Apple previewed iOS 26 together with iPadOS 26, macOS Tahoe 26, watchOS 26 and tvOS 26, the first time every platform shared one number. Apple's newsroom post for the new design lists all five side by side. The number lines up with the year in which most of the release's support life falls: iOS 26 shipped in September 2025 and was the current release through the 2025 to 2026 cycle, and iOS 27 followed in September 2026.

For anyone tracking versions in a spreadsheet, policy file or device management rule, three practical consequences follow:

1. A rule such as "minimum iOS 19" never matches anything. Rules written as "version greater than 18" still work because 26 is larger.
2. iOS, iPadOS, macOS, watchOS and tvOS now share major numbers, which makes cross platform policy simpler. macOS versions before Tahoe still use their own scheme (macOS 15 Sequoia), so Mac rules still need care.
3. The last version before the change, iOS 18, remains a live line for iPhone XS and XR, so an inventory can legitimately show 18.7.x, 26.7.x and 27.0.x at the same time.

How Apple ships iOS fixes: majors, points, letter releases and Background Security Improvements

Apple's security releases page lists every update that came with a security advisory, plus ones it marks "This update has no published CVE entries". Understanding which kind of update you are looking at tells you how urgent it is and how it will install.

Major releases

A major release (iOS 26, iOS 27) arrives each September, previewed at WWDC in June. Its security content note is usually the longest of the year, because it carries fixes that Apple did not backport. The iOS 26 note, released 15 September 2025, lists fixes across components such as the Apple Neural Engine, WebKit and the kernel, each marked "Available for: iPhone 11 and later". A major release is also when device support changes.

Point releases and bug fix releases

Point releases (26.1, 26.2, and so on) ship every few weeks to every couple of months and usually include a batch of CVE fixes. Third digit releases (26.0.1, 26.6.2) are often bug fixes, and some are urgent single fix releases. Apple's page shows the difference directly: iOS 26.6.2 and 26.4.1, for example, are marked "This update has no published CVE entries", while iOS 18.6.2 on 20 August 2025 carried one fix for an ImageIO out of bounds write that Apple said "may have been exploited in an extremely sophisticated attack against specific targeted individuals".

Apple also notes on the releases page that once an update is installed on iOS, iPadOS, tvOS, watchOS or visionOS, it cannot be downgraded to the previous version. That matters for test devices: if you need a device on an older build to reproduce a bug, keep one aside before updating it.

Rapid Security Responses (iOS 16 to iOS 18)

iOS 16 introduced Rapid Security Responses, small updates that patched Safari, WebKit and system libraries without a full point release. They carried a letter after the version. Apple's 2022 to 2023 archive lists, for example, Rapid Security Response iOS 16.5.1 (a) on 10 July 2023, followed by iOS 16.5.1 (c) on 12 July 2023. The idea was to get browser engine fixes, which are the most common entry point for web based attack chains, onto phones in days instead of weeks, and to let the user remove one if it caused a compatibility problem.

Background Security Improvements (iOS 26.1 and later)

From iOS 26.1, iPadOS 26.1 and macOS 26.1, Apple's support article describes Background Security Improvements as "lightweight security releases" for components such as Safari, the WebKit framework stack and other system libraries, delivered between software updates. Apple's releases page links Background Security Improvements to that article (support article 102657). The key facts from Apple:

• They are enabled by default and controlled under Settings > Privacy & Security > Background Security Improvements, with an "Automatically Install" switch.
• If you turn the switch off, the device gets the fix only when it is folded into the next software update.
• If you remove an applied improvement, the device reverts to the baseline update (Apple's example is iOS 26.3) with no improvements applied.
• In rare compatibility cases Apple may temporarily remove one and ship an improved version later.
• They are available only for the latest versions of iOS, iPadOS and macOS. Older lines such as iOS 18.7.x do not get them.

The first published example is the Background Security Improvement for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 and macOS 26.3.2, released 17 March 2026 and labelled iOS 26.3.1 (a). It fixed one WebKit issue, CVE-2026-20643, a cross origin problem in the Navigation API that Apple said could let maliciously crafted web content bypass the Same Origin Policy. That is the pattern Apple designed the channel for: one browser engine fix, shipped without waiting for 26.4.

Which kind of update is which

Security and privacy features in each iOS version

Each subsection lists what Apple itself announced or documented for that version. Where a feature arrived in a point release, the point release is named.

iOS 14 (16 September 2020): privacy labels, approximate location and tracking consent

Apple previewed iOS 14 on 22 June 2020. Its newsroom post described three privacy changes that defined the release:

• Approximate location. When granting location access, users can share an approximate location instead of a precise one. For most apps that ask for location (weather, local news, store finders), approximate is enough.
• Camera and microphone transparency. Apple promised "even more transparency into an app's use of the microphone and camera", so users can see when an app is using them.
• App Store privacy summaries. Product pages gained summaries of each developer's self reported privacy practices. This was the first time the App Store asked every developer to declare data collection in a structured form, which also became a supply chain disclosure: developers must account for what their third party SDKs collect.
• Sign in with Apple upgrades. Users could upgrade existing accounts to Sign in with Apple.

The biggest change came in iOS 14.5, announced 26 April 2021: App Tracking Transparency. Apple's newsroom post says it "requires apps to get the user's permission before tracking their data across apps or websites owned by other companies for advertising", and that apps must get permission to access the device's advertising identifier. Users can review and change each app's permission in Settings.

For security teams, the lesson of iOS 14 is that privacy features double as inventory features. The privacy summaries and the tracking prompt forced app teams to know which SDKs in their build collect what, a question that is impossible to answer honestly without a dependency inventory.

iOS 14 ran on iPhone 6s and later, the first iPhone SE and the seventh generation iPod touch, according to the iOS 14.0 entry in Apple's 2020 to 2021 security archive.

iOS 15 (20 September 2021): Private Relay, Mail Privacy Protection and safer kernel memory

Apple announced the iOS 15 privacy package on 7 June 2021. The headline items:

• iCloud Private Relay, part of the new iCloud+ subscription. Apple describes it as a service built into iCloud that ensures all Safari traffic leaving the device is encrypted, "so no one between the user and the website they are visiting can access and read it, not even Apple or the user's network provider".
• Hide My Email, which creates unique random addresses that forward to the real inbox.
• Mail Privacy Protection, which in Apple's words stops senders from using invisible pixels to collect information about the user.
• App Privacy Report, showing how often each app used location, photos, camera, microphone and contacts over the past seven days, and which third party domains it contacted.
• On device Siri audio processing by default, so request audio stays on the phone.

Below the surface, Apple's security engineering team later wrote that iOS 15 introduced kalloc_type, a secure memory allocator for the kernel that organises allocations by type so that most memory corruption bugs are harder to exploit. That change does not show up in Settings, but it is one of the reasons later iOS kernel bugs needed more complex chains to turn into working attacks.

iOS 15 kept the iOS 14 device list for iPhones (iPhone 6s and later), which is why the 15.x line is still alive in 2026: those phones never got iOS 16. Apple's iOS 15 note lists "iPhone 6s and later" for the 20 September 2021 release, and its most recent 15.8.x updates name "iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation)".

iOS 16 (12 September 2022): Lockdown Mode, passkeys and Rapid Security Responses

iOS 16 was the largest security release in the period:

• Lockdown Mode. Announced 6 July 2022 as "an extreme, optional protection for the very small number of users who face grave, targeted threats", and shipped in iOS 16, iPadOS 16 and macOS Ventura. Apple's support article lists what changes when it is on: most Messages attachment types and link previews are blocked, certain complex web technologies are blocked, incoming FaceTime calls are blocked unless you contacted the caller in the past 30 days, incoming Apple service invitations are blocked, shared albums are removed, the device must be unlocked to connect to an accessory or computer, it will not join non secure Wi-Fi automatically, 2G and 3G are turned off, and configuration profiles and MDM enrollment are blocked. Apple also created a Lockdown Mode category in its bounty program, with doubled bounties "up to a maximum of $2,000,000".
• Passkeys. Apple's 6 June 2022 iOS 16 announcement describes passkeys as unique digital keys that stay on device, are never stored on a web server and sync through iCloud Keychain with end to end encryption, unlocked by Face ID or Touch ID.
• Safety Check. A tool for people whose personal safety is at risk from domestic or intimate partner violence, which quickly removes access they have granted to others.
• Rapid Security Responses, described in the previous section.
• Advanced Data Protection for iCloud (iOS 16.2, 13 December 2022), announced 7 December 2022 alongside Security Keys for Apple ID (iOS 16.3, 23 January 2023) and iMessage Contact Key Verification. Advanced Data Protection extends end to end encryption to more iCloud categories, including iCloud Backup, Photos and Notes. We cover its scope and limits in our Advanced Data Protection post.

iOS 16 raised the floor to iPhone 8 and later, according to the iOS 16 entry dated 12 September 2022 in Apple's 2022 to 2023 archive. That drop is why the iPhone 6s, 7 and first SE stay on iOS 15.

iOS 17 (18 September 2023): hardened Lockdown, private browsing locks and Stolen Device Protection

Apple announced the iOS 17 privacy and security set on 5 June 2023:

• Lockdown Mode expansion. Apple's Lockdown Mode article says additional protections are available starting in iOS 17, iPadOS 17, watchOS 10 and macOS Sonoma, and that the feature now reaches Apple Watch.
• Safari Private Browsing locks when not in use, so private tabs need Face ID, Touch ID or the passcode to reopen.
• Link Tracking Protection in Messages, Mail and Safari Private Browsing removes tracking parameters that some sites add to URLs.
• Communication Safety extended to video as well as still images.
• Check In, which tells a chosen contact when you arrive.
• xzone malloc. Apple's security engineering team wrote that iOS 17 brought a user level counterpart to the kernel's typed allocator.

Then, in iOS 17.3, Apple shipped Stolen Device Protection. Apple's support article says that when the iPhone is away from familiar locations, actions such as using stored passwords and credit cards need Face ID or Touch ID with no passcode fallback, and that some security actions such as changing the Apple Account password need a one hour "Security Delay" followed by a second biometric check. It must be turned on before the phone is lost, and it needs two factor authentication, a passcode, Face ID or Touch ID, Significant Locations and Find My. You can set it to require the delay everywhere by choosing "Always". Our Stolen Device Protection post walks through the settings in detail.

iOS 17.4 brought the EU changes under the Digital Markets Act, covered in its own section below.

iOS 17 raised the floor to iPhone XS, XS Max and XR, dropping iPhone 8 and iPhone X.

iOS 18 (16 September 2024): the Passwords app

Apple's 10 June 2024 iOS 18 announcement introduced the Passwords app, built on Keychain, which collects passwords, passkeys, Wi-Fi passwords and verification codes in one place. Apple says it alerts users about "common weaknesses, such as passwords that are easily guessed or used multiple times and those that appear in known data leaks". Turning credential hygiene into a first party app with breach alerts is a meaningful default for the many people who never installed a separate password manager.

iOS 18 kept the iPhone XS and later floor, according to its 16 September 2024 security note. Two notable iOS 18 point releases show how Apple marks exploitation:

• iOS 18.3 (27 January 2025) fixed CVE-2025-24085 in CoreMedia, a use after free that let a malicious app elevate privileges. Apple wrote that it "may have been actively exploited against versions of iOS before iOS 17.2".
• iOS 18.6.2 (20 August 2025) fixed CVE-2025-43300 in ImageIO, an out of bounds write triggered by processing a malicious image file, which Apple said "may have been exploited in an extremely sophisticated attack against specific targeted individuals".

Because iPhone XS and XR cannot run iOS 26, the 18.7.x line continues to receive fixes. Apple listed iOS 18.7.10 on 17 August 2026 for iPhone XS, XS Max, XR and the seventh generation iPad.

iOS 26 (15 September 2025): Background Security Improvements and Memory Integrity Enforcement

iOS 26 was previewed on 9 June 2025 and released 15 September 2025 for iPhone 11 and later. The security story has three parts:

• Background Security Improvements, available from iOS 26.1, taking over the role Rapid Security Responses played as the between update channel for WebKit and system library fixes (details above).
• Memory Integrity Enforcement (MIE). On 9 September 2025, Apple Security Engineering and Architecture described MIE as always on memory safety protection built into "all models of iPhone 17 and iPhone Air". It combines Apple's typed secure allocators with the Enhanced Memory Tagging Extension (EMTE) in synchronous mode and Tag Confidentiality Enforcement policies, covering key attack surfaces including the kernel. Apple's stated reason is that known mercenary spyware chains against iOS, Windows and Android share one trait: they exploit memory safety bugs. MIE is a hardware plus software feature, so it is present only on devices with the matching Apple silicon, not on every phone that runs iOS 26.
• Enhanced Security for developers. Apple says it is making EMTE available to all developers in Xcode through a new Enhanced Security feature released at WWDC 2025. For app teams, this is the first time a memory tagging option sits in the standard build settings for iPhone apps.

The user facing additions are smaller but useful: Call Screening, which asks unknown callers for details before the phone rings through, and easier setup for Child Accounts with parental controls.

iOS 26 raised the floor to iPhone 11, dropping iPhone XS, XS Max and XR. Apple's iOS 26 security note lists "iPhone 11 and later" in every entry.

After iOS 26: iOS 27

Apple released iOS 27 and iPadOS 27 on 14 September 2026 with a security content note, and iOS 27.0.1 on 28 September 2026, which the releases page marks "This update has no published CVE entries". iOS 27 kept the iPhone 11 floor but dropped several iPads (iPad Pro 12.9 inch third generation, iPad Pro 11 inch first generation, iPad Air third generation, iPad eighth generation and iPad mini fifth generation), which remain on iPadOS 26.7.x. An iOS 27.1 release for a single new model appeared on 23 October 2026 with no published CVE entries. Treat iOS 27 as the current line and iOS 26.7.x as the supported previous line.

Feature by version comparison

How long Apple patches older iOS versions

Apple does not publish a fixed support period for iOS versions in the way some vendors publish end of life dates. What it does publish is the security releases list itself, and the list tells a consistent story for the 2020 to 2026 period:

• The current major version gets every fix, plus Background Security Improvements.
• The previous major version keeps getting point releases for devices that can upgrade, roughly in step with the current one. iOS 26.7 and 26.7.1 shipped on the same days as iOS 27 and 27.0.1 in September 2026.
• Lines whose devices cannot upgrade get occasional updates for years: iOS 15.8.x for iPhone 6s and 7 was still updated on 11 May 2026, nearly four years after iOS 16 dropped those phones in September 2022. iOS 16.7.x for iPhone 8 and X was updated the same day.
• Lines whose devices can upgrade fade out. iOS 17.7 shipped on 16 September 2024, the same day as iOS 18, for the same iPhone XS and later devices. Because every iPhone that ran 17 could run 18, the 17.x line does not appear among Apple's 2026 entries, while 15.8.x, 16.7.x and 18.7.x do.

Three caveats matter more than the dates.

Selected fixes, not all fixes. The older lines receive a subset. You can see it by comparing notes: iOS 18.3 fixed CVE-2025-24085 for "iPhone XS and later", while the exploited version range mentioned in that note was "before iOS 17.2", which means the safe answer for an affected older device was to be on the newest version it could run. When Apple does backport, it is often for issues it has seen exploited. Many other fixes in a major release note never appear on the older line.

Mitigations are not backported. Typed allocators, Memory Integrity Enforcement, Lockdown Mode improvements and Background Security Improvements are architecture changes. An iPhone 8 on iOS 16.7.16 has the CVE fixes Apple chose to ship, but not the newer exploit mitigations that make the next bug harder to use.

Bug fix releases still count. Some older line entries say "This update has no published CVE entries" (iOS 16.7.13 and 16.7.14 in January and February 2026, for example). They can still matter for certificates, carrier settings or system services, so install them anyway.

Which iPhones each version dropped

What this means for a fleet or a hand-me-down phone

For a company fleet, the rule that holds up is: require the current major version, or the previous one at its latest point release, and treat anything else as an exception with an owner. An iPhone XR on 18.7.10 is patched as far as Apple will patch it, but it lacks the iOS 26 mitigations and Background Security Improvements, so it should not carry high value roles such as administrator authentication or code signing approval.

For a family phone handed to a child or older relative, the questions are simpler:

1. What is the newest iOS this model runs? Check the table above.
2. Is that line still on Apple's security releases page in the last six months? If the most recent entry is older than that, plan to replace the phone.
3. Is it actually on the latest point release? A hand-me-down phone often sits on an old build because nobody signed in to update it.
4. Are Stolen Device Protection, Find My and automatic updates turned on under the new owner's account?

An iPhone 7 still receiving iOS 15.8.8 is better than nothing for calls and messages, but it will not receive fixes for every WebKit bug, so it is a poor choice for banking or for a child's first unsupervised browser.

How to read an Apple security release note

Every entry on Apple's releases page links to an "About the security content of" note. They all follow the same pattern, and once you can read one, triage takes a minute.

Here is the structure, using the iOS 18.6.2 note from 20 August 2025 as the example, paraphrased:

A few reading tips:

• Search the page for "exploited". Apple uses two wordings: "may have been actively exploited" and "may have been exploited in an extremely sophisticated attack against specific targeted individuals". Both mean someone used it.
• Read the version range in the exploitation sentence. The iOS 18.3 note says CVE-2025-24085 "may have been actively exploited against versions of iOS before iOS 17.2". That tells you the exploitation Apple knew about targeted older builds, and that devices still on those builds are the priority.
• Check the "Available for" line against your oldest devices. If your iPhone 8 is not in it, check whether a 16.7.x release on the same day carries the same CVE. If no older line release mentions it, assume the older device stays exposed.
• WebKit entries have a WebKit Bugzilla number. The Background Security Improvement note for 26.3.1 (a) lists "WebKit Bugzilla: 306050" next to CVE-2026-20643. WebKit fixes matter to every app that embeds a web view, not just Safari.
• "No published CVE entries" is not "no security changes". It means Apple published no advisory for that update.
• Cross check with CISA's KEV catalog for exploited Apple CVEs. KEV entries carry a "date added" and a federal remediation due date, which many companies use as their own deadline. CISA added CVE-2025-24085 on 29 January 2025, two days after iOS 18.3, and CVE-2025-43300 on 21 August 2025, the day after iOS 18.6.2, with a due date of 11 September 2025. When we checked the feed on 23 October 2026 it held 95 Apple entries, the newest being CVE-2026-86950, a CoreGraphics out of bounds write in iOS, iPadOS and macOS added on 29 September 2026.

How to check your iOS version, enable automatic updates and confirm a security response

The steps below use Apple's documented Settings paths, plus open source command line tools for checking connected devices from a Mac or Linux workstation.

Step 1: check the version on the phone

Open Settings > General > About and read iOS Version. If a Background Security Improvement (or, on iOS 16 to 18, a Rapid Security Response) is applied, the version shows a letter suffix, for example 26.3.1 (a). Tap the version to see the build number.

Step 2: install pending updates

Apple's update article gives the sequence: back up the device, plug in to power, connect to Wi-Fi, then Settings > General > Software Update. The screen shows the installed version and any available update. Tap Download and Install. If a VPN or proxy is on, Apple notes it can prevent the device from contacting the update servers.

If Software Update offers both the latest major version and a point release on your current major version, the point release is the minimum. Choosing to stay on iOS 26.7.x instead of 27 is supported for now; staying on 26.5 is not.

Step 3: turn on automatic updates

Go to Settings > General > Software Update > Automatic Updates and turn on Automatically Install. Apple says the iPhone then downloads and installs updates overnight while charging and on Wi-Fi, and notifies you first. There is also a System Files option under the same screen for system file updates that do not change the software version; leave it on.

Step 4: confirm Background Security Improvements are on

Go to Settings > Privacy & Security > Background Security Improvements and make sure Automatically Install is on. On a Mac, the same setting is in System Settings > Privacy & Security, and Apple notes that Macs started from external storage get the improvements only with the next full update. If you ever remove an applied improvement, the version returns to the base build without the letter.

Step 5: check connected devices from a workstation

For a lab, help desk or family IT situation where several iPhones are plugged into one computer, the open source libimobiledevice tools read the same values without unlocking menus on each phone. The device must be unlocked and must trust the computer.

# macOS (Homebrew) or Debian/Ubuntu
brew install libimobiledevice        # or: sudo apt install libimobiledevice-utils

# list connected devices by UDID
idevice_id -l

# read version, build and model identifier for each device
for udid in $(idevice_id -l); do
  ver=$(ideviceinfo -u "$udid" -k ProductVersion)
  build=$(ideviceinfo -u "$udid" -k BuildVersion)
  model=$(ideviceinfo -u "$udid" -k ProductType)
  echo "$udid,$model,$ver,$build"
done

That prints one CSV line per device: identifier, model identifier (for example iPhone12,1 for iPhone 11), version and build. Compare the version with the newest entry for that model on Apple's security releases page.

Step 6: check exploited Apple CVEs against your versions

CISA publishes the Known Exploited Vulnerabilities catalog as a JSON feed. This lists Apple entries that mention iOS, newest first, so you can see which exploited issues were fixed after the version your devices run:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[]
      | select(.vendorProject=="Apple")
      | select((.product + " " + .shortDescription) | test("iOS"))
      | [.dateAdded, .cveID, .product, .dueDate] | @tsv' \
  | sort -r | head -20

Then open the matching Apple note for each CVE and check the "Available for" line and the version it was fixed in.

Step 7: turn on the protections that are off by default

• Stolen Device Protection: Settings > Face ID & Passcode > Stolen Device Protection. Consider "Always" for the security delay if you travel often.
• Lockdown Mode, only if you may be personally targeted: Settings > Privacy & Security > Lockdown Mode > Turn On Lockdown Mode, then Turn On & Restart. Apple notes it must be turned on separately on iPhone, iPad and Mac, and that a paired Apple Watch follows the iPhone.
• Advanced Data Protection for iCloud, after you set up a recovery contact or recovery key.

Step 8: record the result

For a small fleet, keep the CSV from step 5 with the date and the newest Apple release for each model. For a managed fleet, the same fields (OS version, build, model) are reported by device management, and a compliance rule of "current or previous major at latest point release" maps directly onto them.

Sideloading and alternative app marketplaces in the EU

The EU Digital Markets Act (Regulation (EU) 2022/1925) sets objective criteria for identifying "gatekeepers", which the European Commission describes as large digital platforms providing core platform services such as app stores, and places obligations on them. Apple's developer page on changes for apps in the EU describes how it opened iPhone and iPad distribution in response. Those changes arrived with iOS 17.4, released 5 March 2024 according to Apple's security releases page, and Apple has revised the terms several times since.

What Apple says users in the EU can do today:

• Install apps from alternative app marketplaces, which are themselves apps whose primary purpose is the discovery and distribution of notarized iOS and iPadOS apps.
• Install apps directly from an authorized developer's website through Web Distribution.
• Keep using the App Store, where apps still go through full App Review.

What Apple applies to apps outside the App Store:

• Notarization, which Apple calls "a baseline review that applies to all apps, regardless of their distribution channel". Apple says it combines automated checks and human review and checks that apps are free of known malware, viruses or other security threats, function as promised and do not expose users to egregious fraud. Apps are evaluated against the Notarization Review Guidelines, a subset of the App Review Guidelines.
• Installation sheets built from notarization data, showing the developer, description, screenshots and age rating before download.
• Install time checks that the app has not been tampered with and that the installation came from an authorized marketplace or an approved developer website.

Apple has also changed the commercial terms several times; the current page says the per install Core Technology Fee was replaced by a 5% Core Technology Commission on digital transactions in apps distributed outside the App Store, and that companies no longer need an EU legal entity to run a marketplace or use Web Distribution.

What this means for app supply chain trust

For security teams, the change is about who vouches for an app:

Three practical consequences:

1. Your allowlist needs a source, not just a name. "Approved app: X" is no longer specific enough for EU devices. Record where it comes from (App Store or a named marketplace) and the developer identity.
2. Notarization is a floor. It checks for known malware and policy issues; it does not review an app's dependencies, its update server or its build pipeline. Those are the developer's responsibility, as they always were.
3. App developers carry more of the evidence burden. If you distribute outside the App Store, customers and marketplace operators will ask for the same assurances App Review used to imply: who built it, from what source, with which third party libraries, and how fast you fix a vulnerable dependency.

Common mistakes

• Assuming "up to date" means "fully patched". An iPhone XR on iOS 18.7.10 says it is up to date. It is, for its line, but that line gets selected fixes and none of the iOS 26 mitigations.
• Writing policies for iOS 19. No such version exists. Use "greater than or equal to 26" or name the lines you accept.
• Turning off Background Security Improvements to avoid surprises. Apple says the device then waits for the next full update for those WebKit and library fixes. The rollback path exists for exactly the rare compatibility problem you are worried about.
• Ignoring updates with "no published CVE entries". They can still fix system issues; install them on the same schedule.
• Treating Lockdown Mode as a general hardening switch. It blocks MDM enrollment and configuration profiles, breaks many attachments and some sites, and is designed for people who may be personally targeted. For most users, updates, Stolen Device Protection and a strong passcode matter more.
• Turning on Stolen Device Protection after the phone is gone. Apple is explicit that it must be on before the device is lost or stolen.
• Keeping a downgrade plan. Once an iOS update is installed it cannot be downgraded. Keep a test device on the old build before you update it if you need one.
• Allowlisting EU apps by name only. The same name can come from different distribution channels on EU devices.
• Reading Apple's exploitation wording as rare edge cases. The targeted individuals wording still means the bug works in the real world; other attackers study the fix quickly.

Where Safeguard fits, honestly

Safeguard does not update iPhones, manage devices, read a phone's patch level or scan iOS firmware. The iOS release cycle, the backports to older lines and the Background Security Improvements channel are entirely Apple's, and the only fix for an iOS vulnerability is Apple's update.

Where Safeguard does fit is the software your team builds for iPhone and around it. An iOS app pulls in Swift packages and often JavaScript for React Native or web views, and its backend and build tooling pull in npm, Python, Ruby and container images. Safeguard's dependency scanning covers ecosystems including JavaScript, Python, Java, Go, Rust, Ruby, .NET and PHP, plus container images and SBOM files; do not assume native Swift package coverage without checking the documentation for your stack. For the parts it covers, Safeguard finds known vulnerable components, shows which projects carry a given component and version, ranks findings by reachability, and can open fix pull requests (switched off by default) when a safe version exists. That is useful exactly where the EU distribution change raised expectations: when a marketplace, customer or auditor asks what is inside your app and how quickly you fix a vulnerable library.

FAQ

What is the latest version of iOS?

As of 23 October 2026, Apple's security releases page lists iOS 27.0.1 as the latest version for iPhone 11 and later, with iOS 27.1 released for a single new model. iOS 26.7.1, released 28 September 2026, is the latest update on the previous line.

Why did Apple go from iOS 18 to iOS 26?

At WWDC on 9 June 2025, Apple gave iOS, iPadOS, macOS, watchOS and tvOS one shared version number, 26, and named the iPhone release iOS 26. There is no iOS 19 to 25. The number lines up with the year in which most of the release's support life falls.

Which iPhones can run iOS 26?

iPhone 11 and later. Apple's iOS 26 security note lists "iPhone 11 and later" for every fix. iPhone XS, XS Max and XR stay on iOS 18.

Does Apple still update iOS 15 and iOS 16?

Yes, for the iPhones that cannot upgrade. Apple released iOS 15.8.8 for iPhone 6s, 7 and the first iPhone SE, and iOS 16.7.16 for iPhone 8 and X, on 11 May 2026. These updates carry selected fixes, not every fix in the current version.

How long does Apple support an iPhone with security updates?

Apple does not publish a fixed number of years. In practice the newest major version a phone can run keeps getting occasional fixes for several years after the phone is dropped: iPhone 6s and 7 were dropped by iOS 16 in 2022 and still received an update in May 2026. Check Apple's security releases page for the most recent entry naming your model.

What are Background Security Improvements on iPhone?

Lightweight security releases for Safari, WebKit and other system libraries that install between software updates, starting with iOS 26.1. They show as a letter after the version, such as 26.3.1 (a), and are controlled in Settings > Privacy & Security. They do the job Rapid Security Responses did on iOS 16 to 18.

What does "may have been actively exploited" mean in an Apple update?

It means Apple received a report that the vulnerability was used in real attacks before the fix. Install that update immediately, and check whether your older devices have a matching update on their own line.

Should I turn on Lockdown Mode?

Only if you might be personally targeted because of who you are or what you do, which is how Apple describes the audience. It blocks many attachments, some web technologies, unknown FaceTime calls, configuration profiles and MDM enrollment. Most people get more protection from automatic updates and Stolen Device Protection.

Can you sideload apps on iPhone?

In the EU, yes: users can install notarized apps from alternative app marketplaces and from approved developer websites, under Apple's Digital Markets Act changes that began with iOS 17.4. Outside the EU, apps still come from the App Store, apart from developer and enterprise distribution channels.

How do I check if my iPhone has the latest security update?

Open Settings > General > About to see the version, then Settings > General > Software Update to see whether anything newer is available. Compare the version with the newest entry for your model on Apple's security releases page (support.apple.com/100100).

Phones get their fixes from Apple, but the apps that run on them do not: an iPhone app ships with its own Swift packages, pods, JavaScript and server side dependencies, and an iOS update cannot fix a vulnerable library inside your app. The fit here is for the code your team builds and ships around iPhone, not for iOS itself.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos update an iPhone, change iOS settings or read a device's version. They show how Safeguard handles the software you build for iPhone and the machines you build it on.

The first demo is a real session with the Safeguard mobile app on Android: you send work to a computer running the Safeguard CLI, then approve the command on the phone with Allow once, Allow for turn or Deny. For an iOS team, the same pattern means a dependency fix in your app's repository can be started and approved from a phone while the build machine does the work.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow applies to the JavaScript in a React Native app or a web view bundle, and to the backend services your iPhone app talks to, whenever a fixed version exists.

Click through it at your own pace, or open it full screen.

The third demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. That is the route for scanning the JavaScript, Ruby tooling and backend code around an iOS project on the Mac where you build it, for example after an upgrade has pulled new package versions.

Click through it at your own pace, or open it full screen.

To try the CLI, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Apple security releases (support.apple.com/100100)
• Apple security updates, 2020 to 2021 archive
• Apple security updates, 2022 to 2023 archive
• About the security content of iOS 26 and iPadOS 26
• About the security content of iOS 18 and iPadOS 18
• About the security content of iOS 18.3 and iPadOS 18.3
• About the security content of iOS 18.6.2 and iPadOS 18.6.2
• About Background Security Improvements for iOS, iPadOS and macOS
• Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 and macOS 26.3.2
• About Lockdown Mode
• About Stolen Device Protection for iPhone
• Update your iPhone or iPad
• Apple Platform Security guide
• Apple Security Research: Memory Integrity Enforcement (9 Sep 2025)
• Apple Developer: Changes for apps in the European Union
• Apple Newsroom: Apple reimagines the iPhone experience with iOS 14 (22 Jun 2020)
• Apple Newsroom: iOS 14.5 offers Unlock iPhone with Apple Watch, diverse Siri voices and more (26 Apr 2021)
• Apple Newsroom: Apple advances its privacy leadership with iOS 15 (7 Jun 2021)
• Apple Newsroom: Apple unveils new ways to share and communicate in iOS 16 (6 Jun 2022)
• Apple Newsroom: Apple expands commitment to protect users from mercenary spyware (6 Jul 2022)
• Apple Newsroom: Apple advances user security with powerful new data protections (7 Dec 2022)
• Apple Newsroom: Apple announces powerful new privacy and security features (5 Jun 2023)
• Apple Newsroom: iOS 18 makes iPhone more personal, capable, and intelligent than ever (10 Jun 2024)
• Apple Newsroom: Apple elevates the iPhone experience with iOS 26 (9 Jun 2025)
• Apple Newsroom: Apple introduces a delightful and elegant new software design (9 Jun 2025)
• CISA Known Exploited Vulnerabilities catalog and its JSON feed
• European Commission: About the Digital Markets Act

Last reviewed: 23 October 2026. Apple adds iOS releases and older line updates every few weeks; check Apple's security releases page before planning around these dates.