iPhone owners running older software have a reason to check their installed version after new research traced web-delivered Coruna and DarkSword attacks through October. The vulnerabilities mapped in the report already have patches. The practical task is to install the update offered for your particular phone, including older models that cannot run the newest major iOS release.
Zimperium's October 29 analysis identified 608 domains delivering Coruna-family code. Researchers found separate paths for older software and an iOS 18 chain derived from DarkSword. Their device observations included successful theft of an Apple Notes database on iOS 18.6.2.
That is evidence of a working attack against an older build. It does not establish that a phone running current software can be compromised by the same chain, or that visiting any one website proves a particular person was infected.
What changed, and what was already patched
The new analysis connects delivery sites, recovered code and device behavior. It describes pages that can look ordinary while a hidden frame loads attack code, without an app installation or a permission prompt. Some delivery involved compromised legitimate sites. The number of domains measures infrastructure, not the number of victims.
The underlying threat has a longer history. Google Threat Intelligence Group reported DarkSword on March 18, describing attacks against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. Its analysis covered iOS 18.4 through 18.7 and six vulnerabilities. Google said all were patched by the release of iOS 26.3, with most fixed earlier.
Those dates separate new campaign research from the discovery of a new unpatched flaw. Zimperium likewise says every vulnerability mapped in its analysis targets an already-patched issue. Updating closes known routes described by the researchers; it is not a diagnosis of whether a device was previously compromised.
Match the update to your iPhone
Apple's security release list, checked October 30, shows different update branches for different hardware:
| iPhone model | Recent release listed by Apple | Release date |
|---|---|---|
| iPhone 11 and later | iOS 27.2; iOS 26.7.2 also listed | October 26, 2026 |
| iPhone XS, XS Max and XR | iOS 18.7.11 | October 26, 2026 |
| iPhone 8, 8 Plus and X | iOS 16.7.16 | May 11, 2026 |
| iPhone 6s, 7 and first-generation SE | iOS 15.8.8 | May 11, 2026 |
These are release-list entries, not a promise that every phone receives every version or that every branch has identical protections. In particular, an XR running the latest available iOS 18 update should not be confused with the much earlier iOS 18.6.2 used in the research.
Check the installed version before assuming an update finished
Apple's update instructions direct users to Settings, General, then Software Update. That screen shows the installed version and whether an update is available. Back up the phone, connect it to power and Wi-Fi, and follow the installation instructions.
A downloaded update and an installed update are different states. Under Software Update, Automatic Updates provides separate controls for automatic downloading and installation. Check the version after installation rather than relying on having seen a download notification.
Apple also provides a computer-update route when the update does not appear on the device. A work-managed phone may require help from the organization's support team. The model-specific release list provides a concrete reference when asking which update the device should receive.
When Lockdown Mode is worth considering
Apple describes Lockdown Mode as an optional extreme protection for people who may be individually targeted by highly sophisticated attacks. It limits some websites, message attachments and other features. Most people will never be targeted by attacks of that nature, Apple says.
The setting is available from iOS 16. On iPhone, open Settings, Privacy & Security, then Lockdown Mode and follow the turn-on and restart prompts. Apple recommends updating first for the complete set of protections.
Google recommends Lockdown Mode for enhanced security when updating is not possible. It reduces available features and attack surfaces; it does not replace installing an available patch. Phone calls, plain text messages and emergency features continue to work, though some other communications and web experiences change.
