7 ms·
About the security content of iOS 15.8.5 and iPadOS 15.8.5
- bigyabai 1y agoWell, good. The moment they stop, it's declared E-waste and Apple suggests you give it to them for free. Fucked-up world we live in where a disposable vape can be reused for more purposes than an iPhone with expired software support.
- duxup 1y agoI got plenty of old iPhones I can still use. My pile of old android phones ... they sadly do not live long overall as far as a % of survivors goes. A few have lived long lives for sure, but overall not as many as my old iPhones.
- MrTrvp 1y agoUnfortunately I think it'll be much worse in the coming years with Google's ban on ban sideloading apps and other companies following them.
- duxup 1y agoFor whatever reason I don't sweat that condition in Apple land, but I do find it very worrisome to see Android land forego side-loading.
- galaxy_gas 1y agoit was upfront disclosed in Apple land in that I knowingly know this to be true and do not expect it as a feature but it is a surprise new condition with no notice in Android land that makes it such worrisome action
- chasil 1y agoChoose phones supported by LineageOS where the bootloader can be unlocked, and you can easily outlast iOS.
- duxup 1y agoMy experience just with the hardware doesn't match that. My android devices just tend to fail over time more often than iPhones. Granted, there's PLENTY of other good reasons to make that choice even with that condition. So I don't disagree generally.
- bigyabai 1y agoCan't say my experience matches yours, either. I too have a box of unsupported mobile devices; the stuff I can do on an Android device clears every iOS one. I can't install apps on iOS without a desktop and a specific unsupported iTunes client. I can only use a subset of iOS functions. My Android phones still do everything they say on the tin. Regardless, you've worded your entire argument to be orthogonal to my original point so it's clear you're not arguing in good faith. Nothing you ever said was related to the principles I mentioned, just what you consider to be personally valuable. Which is fine, but akin to responding to a health food nut by saying how great burgers taste.
- Gigachad 1y agoI used to do this back when I was on Android and official updates only lasted 1-2 years. Now I’m on an iPhone I get official OS updates for such a long time I don’t need to worry about flashing custom roms.
- chasil 1y agoI want root reliably. Every version of Lineage offers rooted debugging, even without Magisk. I know that root can be obtained in iOS, but Apple really prefers that users be restrained from this capability.
- TranquilMarmot 1y agoEver since the Pixel 2, the Android phones put out by Google have been long lasting. I have a Pixel 2 XL that still works just fine and it's now 8 years old. Doesn't get OS updates but it works.
- deleted 1y ago[deleted]
- rgovostes 1y agoI am out of date on the latest from the jailbreak scene, but checkra1n supports the device up to iOS 14. If you updated to iOS 15, there may not be a full jailbreak, but not all is lost. The latest release of Xcode, Xcode 26, still allows you to build apps for iOS 15. At some point you will have the secondary problem of needing an older Xcode which only runs on an older macOS, though Apple has been doing the minimum to make it possible to acquire both of these. With a free Apple Developer account, you can sign and side load your apps, but they expire every 7 days, and you wouldn't be able to add any restricted entitlements. But the TrollStore exploit (https://github.com/opa334/TrollStore https://github.com/opa334/TrollStore), which I cannot vouch for, seems to work around these limits. So: It seems like if you are the kind of person who keeps disposable vapes to reprogram the microcontrollers, the iPhone 6S should actually be an attractive device worth keeping: - Runs an operating system released in September 2021 and received regular bug fixes and security updates through July 2024. Still receives occasional security updates as of September 2025. Not completely end-of-life. - Supported by the latest developer tools, probably through June 2026, with older downloads available (https://xcodereleases.com/ https://xcodereleases.com/). - Known jailbreaks and exploits to maximize utility. It's not surprising that the trade-in value for a 10-year-old device is nil, but on the secondary market they fetch about $60 (https://swappa.com/prices/apple-iphone-6s https://swappa.com/prices/apple-iphone-6s) which is not bad if you consider the device capabilities compared to most hobbyist devkits.
- cookiengineer 1y agoI think if we're comparing the easiness of repurposing an EOL phone, it is much better to just check the postmarketOS wiki for supported devices and pick one of those instead. They got great instructions for reflashing/jailbreaking the bootloaders etc. And yes, you get a full blown Linux with it. So you can, like me, repurpose your smartphones into pretty much everything. I have removed their batteries and have them solar powered as Freifunk routers and even offline-ready kiwix media servers among other things. [1] https://wiki.postmarketos.org/wiki/Devices https://wiki.postmarketos.org/wiki/Devices
- uni_baconcat 1y agoIf old iPhone can be easily hacked like a disposable vape, of course you can repurpose it. But you can’t.
- sunrunner 1y ago> Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Even if there was no mention of this or the implication that it’s linked to the notifications Apple sends for targeted attacks, is it fair to say this kind of backdated security patch implies a lot about the severity of the vulnerability? What’s Apple’s default time frame for security support?
- altairprime 1y agoNo specific timeframe is defined, but they tend to release things that matter really far back — like, the Apple CA certificate expiration update went out a few years ago to basically the entire deployed Square terminal iPad userbase, etc. I expect it’s driven by telemetry and threat model both. Presumably the cutoff is wherever the telemetry ceases!
- zomiaen 1y agoAlmost certainly some kind of zero click/zero user action RCE exploit. Edit: I should've read, "Impact: Processing a malicious image file may result in memory corruption." So simply receiving an image via SMS or loading it in some other way likely accomplishes the initial exploit, so yeah, zero click exploit. Always bad.
- duxup 1y ago> is it fair to say this kind of backdated security patch implies a lot about the severity of the vulnerability? That is my assumption, that the result is a pretty severe impact and/or the victim has little to no way to prevent it (zero click situation). Granted I can't speak for Apple, but I was thinking along the same lines you were.
- sfilmeyer 1y ago> What’s Apple’s default time frame for security support? This isn't thaaaaat far out of support. Their last security update for iOS 15 was just earlier this year, and they only dropped iPhone 6s from new major versions with iOS 16 a few years ago. As someone who has kept my last few iPhones for 5+ years each, I definitely appreciate that they keep a much longer support window than most folks on the Android side of things.
- scosman 1y ago> Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- jerlam 1y agoThis specific vulnerability was already known and exploited - and patched by Apple - three weeks ago on devices that Apple deemed "current".
- bombcar 1y agoThis reeks in all possible ways of nation state activity.
- deleted 1y ago[deleted]
- hopelite 1y agoOne single nation
- brcmthrowaway 1y ago[flagged]
- deleted 1y ago[deleted]
- alexchantavy 1y agoBunch of negativity on Apple UI recently, but you gotta give Apple credit for supporting really old phones. Google Pixel, forget about it lol
- Dylan16807 1y agoPixels 8 and later get 7 years. Not as good as Apple but reasonable. Pixels 6-7 got 5 years. I'd say that's on the low end of okay. For "lol" you have to go back to 2021 or earlier. Or look at some of Motorola's offerings.
- nebula8804 1y agoI left Android at the Nexus 5 after years of buying every Nexus phone. The deal breaker: Despite staying on official ROMs, Google broke audio in video recording such that all my vacation videos with a special friend ended up with garbled audio. My mistake for trusting Google updates right before my trip. You'd think for their reference phone they would test a primary feature like video recording for regressions? Apparently not. My friend at the time had an iPhone 5, I noticed her phone worked without issue while my Nexus 5 was constantly draining its battery. I finally bought an Apple device and 11 years later never looked back. Finally said goodbye to Windows & Linux as well. I presume this is how many Apple conversions happen. Back when Pixel came out I used to argue with a friend because it supposedly had a better camera: I'd always point out that the Pixel phone has its own Wikipedia article describing all its issues: https://en.wikipedia.org/wiki/Pixel_(1st_generation)#Issues https://en.wikipedia.org/wiki/Pixel_(1st_generation)#Issues Its been like 12 years since the G1? They are still playing games till this day. Give it a rest already.
- awill 1y agoI remember when Google broke 911 calling, and decided it was ok to wait for the next maintenance patch to fix it. People could have died, but Google just couldn't hurry up and release an emergency patch.
- 1y ago
- transpute 1y ago"iOS 18.6.1 0-click RCE POC", 50 comments, https://news.ycombinator.com/item?id=45019671 https://news.ycombinator.com/item?id=45019671
- bri3d 1y agoAnd since nobody got to it in the other thread, https://www.whatsapp.com/security/advisories/2025/ https://www.whatsapp.com/security/advisories/2025/ . It seems to me that this exploit was used in a chain with a WhatsApp issue that would trigger the malicious DNG data to be loaded as a zero click, presumably just into WhatsApp. It’s unclear to me if there was a sandbox escape or kernel vulnerability used along with this; it might have been used to exfiltrate WhatsApp messages only. This would explain why there’s only a single patch for a simple memory corruption issue; usually an attacker would need a lot of chained vulnerabilities to bypass mitigations on iOS, but if the vulnerability is in the exact target application to begin with, it sure does make things easier.
- penguin_booze 1y agoI'm no Apple fanboi--quite the opposite. But I take a note of this act and tip my hat, considering how Android OEMs have been pumping out abandonwares.
- BobbyTables2 1y agoKudos to Apple but are they going to update iPhone 8 firmware too? Think it’s been over a year since the final release. (Surely security vulnerabilities have been discovered since then!!)
- lansol 1y agoApple does support their phones for some time. But note that 10 years is only if you bought the iPhone 6s when it was new and at its most expensive. The iPhone 7 (Plus) wasn't discontinued until 2019 and is on the same iOS version. So it got something like 3 years of OS upgrades (impacting app support) and 6 years of security upgrades in the worst scenario.
- jama211 1y agoMate if you go by when manufactures stop selling devices, there’ll be android devices with _negative_ support years. And that’s 6 years _so far_.
- Aachen 1y agoThat's the fair way to look at it though. You don't expect to get three months' less warranty when you buy a model three months after release. It's also how the EU software upgrade requirements work: 5 years (or more) after they discontinue the model and stop producing it
- jama211 1y agoAnd it’s a fair point for me to make that if you want to look at it that way, you need to be consistent about looking at it that way across all offerings.
- curtisszmania 1y ago[dead]
- joecool1029 1y agoMight as well say it since nobody else commented about it, but modem/soc vendors are huge limiting factor on longterm android support. Qualcomm maintains these updates for only a few years, basically nothing earlier than around 2020-2021 gets kernel driver or modem updates. Of course it's still up to phone manufacturer to integrate these changes, but it puts an effective security support timeline on even 3rd party ROM's like lineageos. They can cherrypick, but it's not as secure once that support ends. Apple has almost everything in-house (except until recently, modems). So they have a ton of flexibility in continuing to provide updates.
- loeg 1y agoSure, but like, this is a fundamental flaw with the Android model. It's valid to criticize Android for this.
- worthless-trash 1y agoThe other fundamental flaw in the iphone market is that NOBODY can fix bugs in ios but apple, I have personally fixed bugs in my android builds.
- testdelacc1 1y agoThat’s great for you. But it doesn’t make a difference to the other 99.999999% of users who only install whatever is available from automatic system updates. It’s the equivalent of saying in response to a political issue that affects all of society - doesn’t really affect me because I flew to my private island. We’re happy for you, but how does that advance the conversation?
- worthless-trash 1y agoJust because everyone doesn't do what I do, doesn't make it wrong.
- 1y ago
- logankeenan 1y agoIt’s great that they made an update. It’s not clear to me if this can result in a RCE. If it does, then does this mean that enough iPhone 6s are still out in the wild where a bad actor could easily take over a big enough portion to do more nefarious things?
- unfocused 1y agoNot surprised. I met with Samsung for work purposes to buy hundreds of phone, and the best they could do with their flagship phones was offer 3 years of security updates. This was around 2019. Apple, who didn't meet with us, was around 6 years from our estimate. From a ROI, for corporate phones, Apple iPhones had a longer lifespan, which is why we bought hundreds of iPhones, and not Androids. On a personal note, I had the Nexus S, the Nexus 5, and they all died a horrible death either from lack of updates, or just having the physical button break, and the microphone stop working. And let us not speak of Sony Xperia Z5, which all of sudden removed their fingerprint sensor due to a North American patent problem. They also broke their bluetooth audio so that song names STOPPED being displayed. That was all in a span of less than 3 years. Never again Sony Android phones. At that point, I got fed up of custom ROMS and joined the "iPhone, it just works" group and moved on.
- mastercheif 1y agoFwiw Samsung is now 7 years OS/Security on flagships and 6 years OS/Security on the entry/mid-level Galaxy A Series.
- Aachen 1y ago"it just works" is the biggest lie they sell. It works only insofar as you use what 95+% of people use. Step outside and not only is it a big gamble, you've also got no way to debug anything. It's a world of walls and limitations with no Windows in sight You seem to have hit all the bad luck and concluded (fairly) that anything but Apple must be bad. I seem to have hit all the bad luck on the Apple side. The device I got from work ran out of updates after fewer years than I privately use my Android, and not before the touchscreen partially broke, various apps had software issues that didn't manifest on other (identical) phones, the battery went bad, and certain OS features like hotspot didn't work half the time you tried to turn them on. I've simply never had these issues on Android, and if e.g. an app doesn't work, I can just wipe its data. On iOS there's no such button; it's not something you should need because in 95+% of cases "it just works" and so they don't let you. It's not your device Currently I'm trying to help an Apple user whose email client broke, both on iOS and macOS, with unexplainable "could not connect" behavior that no other user is seeing (Windows, Android, and Linux all represented). It differs whether they use mobile data or WiFi, but in different ways on different OSes and email clients. Sometimes IMAP works partially (connecting, fetching mail, but not loading folders). I'll probably have to travel 90 minutes each way to see what I can debug on their device. They're tech savvy and we're both perplexed by the different behaviors but there isn't much you can see on iOS so we had given up on mobile email. Now that it's happening on macOS as well suddenly, maybe we can figure something out It's just not a vendor I'd want to work with myself because there keep being major issues with very limited ways of fixing them. I'm sure most of the functions "just work", just like most Android phones "just work" and you hit a bad apple with that Sony device. At least on Sony you can install a different OS if the issues are major enough that people put in the effort of making one
- Bud 1y ago[dead]
- sinuhe69 1y agoI wish they would do the same for iOS 17, instead of forcing users to upgrade to iOS 18. A bunch of superfluous works and many of them even erroneous. Alarm clock for example: if you didn't allow it to snooze, pressing on the power button will snooze it, but without the possibility to turn it off easily. Why on earth would somebody rewrite the alarm clock?!
- abhimanyouknow 1y agohonestly this is incredible, though i'm not sure how the android space is catching up? apparently google and samsung have been promising 5/6 years of software updates recently as well
- TranquilMarmot 1y ago7 years of (supposed) support for newer Pixel phones
- daveoc64 1y agoThe EU now requires that smartphones and tablets receive a minimum of 5 years of security updates - starting from the end of sale. A product information sheet must be published for each new device, and one of the categories included is how long the device will receive security updates: e.g. for iPhone 17 Pro: https://regulatoryinfo.apple.com/cwt/api/ext/file?fileId=energyLabels/A3523_V1/A3523/A3523_Product_Information_Sheet_EN_EU.pdf https://regulatoryinfo.apple.com/cwt/api/ext/file?fileId=ene...
- varenc 1y agoIt's interesting Apple is doing this specifically to protect old devices from seemingly nation state sponsored attacks: > Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- sneak 1y agoI think they are doing this to protect millions of people from mass attacks once the nation-state attack gets RE’d in the next few hours/days and deployed by non-governments, much more likely.
- testdelacc1 1y agoPeople who might be targeted by nation state actors should really be running a phone that’s on the latest OS. It wouldn’t cost that much to not use a 9 year old phone. If you’re remotely afraid of your government, you can afford a phone released within the last 5 years. It’s worth it!
- handsclean 1y ago> If you’re remotely afraid of your government, you can afford a phone released within the last 5 years. Why in the world would you think that? Who do you think governments target, Bond villains?
- SSLy 1y agoJournalists mostly. Also prosecutors, judges, opposition party members.
- duxup 1y agoAnd potentially friends, family, kids? I've always wondered, if you can't hack your main target's phone, but their kid has an old iPhone you can hack and maybe bug (let's just say you can for the argument's sake), you sure as hell do it right? Scary thought but I think it's reasonable to be concerned that not just a given sensitive target is directly at risk, but those around them as well.
- tbphp 1y ago[dead]
- oaiey 1y agoWell you need to protect the store. This sounds like something useful to root a device.
- LocalH 1y agoHeadline is slightly misleading. It implies that the update is only available on the 6s, when in reality it's available for: > iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation) That's a lot of devices, more so than "10-year old iPhone 6s" implies. I won't be upgrading my iPhone 7 and 4th gen iPad mini, because I don't want to take the chance that the update needs an update to Dopamine to be jailbroken. Fortunately they're secondary devices for me.
- jama211 1y agoI think it’s just highlighting the oldest device that got the update, not a huge deal
- jb1991 1y agoIt was a huge enough deal that the title of this post got changed.
- jama211 1y agoThat’s not a high bar, and you’re making some assumptions there, and even if it was entirely that I would still argue the old title was fine. Not misleading, just a highlight.
- gield 1y agoiPad Air 2 was released in October 2014 so the iPhone 6s is not even the oldest device in the article.
- jama211 1y agoFar less people care or remember about the ipad release dates compared to phone release dates, so it’s a reasonable editorial choice.
- LocalH 1y agoA week old but I did say "slightly" misleading, not downright untrue
- iqandjoke 1y agoIf Apple followed Security Development Lifecycle (SDL) well, the update should not be here.
- feisty0630 1y agoAnd if drivers followed the Safe Driving Protocol (SDP), we wouldn't need airbags. Real life happens regardless of the imaginary frameworks infosec people dream up.
- occz 1y agoThis doesn't really mean much on account of the iOS ecosystem only supporting the latest two OS versions in their apps as a general rule. Once you are behind 2 versions, your device becomes quite useless at that point
- Jaxan 1y agoQuite useless?! I still use my iPhone SE (1 gen) from 8 years ago. It’s working perfectly fine for my daily business. Sure, some newer apps I cannot install, but so far I’m not missing anything important. Banking apps work, navigations works, obviously the browser still works, etc
- brewmarche 1y agoI have the same phone but to be fair some websites stopped working (GitHub is among them) and some of my banking apps stopped getting updates as well. No huge deal breakers _personally_ as I don’t need banking on my phone anyway (I have an iPad at home, and also checked that the banks offer authentication devices like TAN generators if I really need to get out of the iOS/Android ecosystem). Apple Pay still works fine. I hope that small phone has a long life ahead of it still :)
- barbs 1y agoSame here. I've noticed that the minimum iOS version for a lot of apps is currently 15 so I'm expecting this to increase to 16 and make my phone redundant, but until then I'll run this phone into the ground!
- egorfine 1y agoCudos to Apple for those updates. Although I'm not sure that people who are running an OS/device that ancient are the ones that are going to upgrade or even know what an upgrade is.
- hsbauauvhabzb 1y agoThe phone will prompt them to update. It’s displayed as if you’re unlocking your phone, a dark pattern for the greater good.
- egorfine 1y agoI didn't knew that. Good!