VulnerabilitiesHIGH

Apple iOS 18 Update - Blocks DarkSword Exploit Attacks

Featured image for Apple iOS 18 Update - Blocks DarkSword Exploit Attacks
BCBleepingComputer
DarkSwordiOS 18CVE-2025-31277CVE-2025-43529Apple
🎯

Basically, Apple is updating more iPhones to protect against a dangerous hacking tool called DarkSword.

Quick Summary

Apple has expanded its iOS 18 updates to more devices, blocking the DarkSword exploit kit. This move helps protect users from ongoing web attacks, ensuring their data remains secure. If you have an eligible device, make sure to enable Automatic Updates for the latest protections.

What Happened

On April 1, 2026, Apple announced an important update for iPhones running iOS 18. The company made it possible for more devices to receive security updates against the DarkSword exploit kit, which has been actively exploited. The latest version, iOS 18.7.7, is now available for users who have Automatic Updates enabled, ensuring they receive crucial protections against these web attacks.

The DarkSword exploit kit targets vulnerabilities in iPhones running versions from iOS 18.4 to 18.7. Apple has been releasing fixes for these vulnerabilities since 2025. However, by late 2025, updates became limited to newer devices, leaving many users unprotected. With the recent update, Apple aims to secure older devices from this significant threat.

Who's Affected

The expanded update now includes a wide range of devices, such as:

  • iPhone XR, XS, XS Max, 11, 12, 13, 14, 15, and 16 models
  • iPad mini (5th generation), iPad (7th generation), and various iPad Pro models

These updates are crucial for users who have opted to remain on the older iOS 18 system rather than upgrading to iOS 26. By enabling these updates, Apple is working to protect a significant number of users from the vulnerabilities exploited by DarkSword.

What Data Was Exposed

The DarkSword exploit kit utilizes six known vulnerabilities, tracked as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. These vulnerabilities have been linked to various attacks, including the deployment of information-stealing malware like GhostBlade, GhostKnife, and GhostSaber.

The exploit kit has been used not only by commercial surveillance vendors but also by suspected espionage groups. This broad targeting indicates a significant risk for users, making the recent updates essential to safeguard personal data and privacy.

What You Should Do

If you own an iPhone or iPad that is eligible for the iOS 18.7.7 update, ensure that your Automatic Updates are enabled. This will help you receive the latest security patches without any manual intervention. Additionally, consider upgrading to the latest iOS version if your device supports it, as newer versions typically offer improved security features.

Stay informed about potential threats and regularly check for updates. Cybersecurity is a shared responsibility, and keeping your device secure is a crucial step in protecting your data from malicious actors.

🔒 Pro insight: The resurgence of the DarkSword exploit kit highlights the importance of timely updates for legacy systems, especially as threat actors increasingly target older vulnerabilities.

Original article from

BCBleepingComputer· Lawrence Abrams
Read Full Article

Related Pings

HIGHVulnerabilities

Vim Vulnerability - Attackers Can Execute OS Commands

A new vulnerability in Vim allows attackers to execute commands on users' systems. Developers are particularly at risk as this flaw can be exploited by opening a malicious file. Immediate updates to Vim version 9.2.0276 are essential to mitigate this threat.

Cyber Security News·
CRITICALVulnerabilities

Nginx-UI Vulnerability - Critical PoC Exploit Released

A critical flaw in Nginx-UI's backup restore mechanism has been disclosed. Unpatched systems are at immediate risk of compromise. Administrators must upgrade to the latest version to mitigate this threat.

Cyber Security News·
HIGHVulnerabilities

Google Dawn Flaw - CISA Adds CVE-2026-5281 to Catalog

CISA has flagged a critical vulnerability in Google Dawn, urging users to update their browsers immediately. This flaw allows remote code execution, putting many at risk. Stay safe by updating now.

Security Affairs·
HIGHVulnerabilities

TrueConf Zero-Day Exploit - Hackers Push Malicious Updates

Hackers are exploiting a zero-day vulnerability in TrueConf to push malicious updates. Over 100,000 organizations, including government agencies, are at risk. Immediate patching is essential to prevent exploitation.

BleepingComputer·
CRITICALVulnerabilities

Chrome Zero-Day CVE-2026-5281 - Google Urges Immediate Update

Google has patched a serious zero-day vulnerability in Chrome, tracked as CVE-2026-5281. This flaw affects the WebGPU component and is actively exploited. Users should update their browsers immediately to protect against potential attacks.

Security Affairs·
HIGHVulnerabilities

Cisco Security Advisory - Multiple Vulnerabilities Addressed

Cisco has issued a security advisory addressing critical vulnerabilities in multiple products. Users must update their systems to mitigate risks. Protect your data by acting quickly.

Canadian Cyber Centre Alerts·