Apple has aggressively broadened the deployment of iOS 18.7.7 and iPadOS 18.7.7, pushing the update to millions of additional devices via Automatic Updates to defend users against the DarkSword exploit, a sophisticated, web-based attack vector capable of silently compromising unpatched iPhones and iPads.
Originally released on March 24, 2026, Apple escalated the forced rollout on April 1, 2026, signaling the company’s urgency in neutralizing the threat before widespread exploitation could take root.
DarkSword is a critical web-based attack chain that leverages malicious web content to silently compromise Apple devices without requiring physical access or user interaction beyond visiting a compromised page.
While foundational mitigations were introduced in 2025, iOS 18.7.7 delivers mandatory, device-wide protections designed to close remaining attack surfaces that threat actors could still target.
Because DarkSword relies entirely on web-based delivery mechanisms, making every browser session a potential entry point, Apple determined that an expanded, push-enforced update was necessary to ensure no active device remained exposed.
The update supports a broad hardware range, from the iPhone XR through the latest iPhone 16 lineup, as well as multiple iPad generations, maximizing coverage across the installed base.
Over 15 Critical Vulnerabilities Patched
Beyond the DarkSword protections, iOS 18.7.7 closes more than 15 significant security flaws spanning the kernel, WebKit, networking, and privacy subsystems. The most severe vulnerabilities addressed include:
| Component | CVE | Impact |
|---|---|---|
| Kernel | CVE-2026-20687 | Use-after-free memory issue enabling system crash or unauthorized kernel memory writes |
| WebKit | CVE-2026-20643 | Cross-origin logic flaw in Navigation API allowing Same Origin Policy bypass via web attacks |
| Security | CVE-2026-28864 | Insufficient permissions checking exposing Keychain credentials to local attackers |
| Clipboard | CVE-2026-28866 | Symlink validation flaw letting apps silently read sensitive clipboard data |
| Network | CVE-2026-28865 | 802.1X authentication state mismanagement enabling network traffic interception |
Apple also addressed serious privacy regressions in this update. A WebKit vulnerability (CVE-2025-43376) was patched that previously allowed remote attackers to view leaked DNS queries even when iCloud Private Relay was active, a significant breach of the privacy promise that feature is built upon.
Additionally, permission flaws in iCloud and Crash Reporter (CVE-2026-28880 and CVE-2026-28878) were resolved.
These bugs enabled rogue applications to silently enumerate other apps installed on a user’s device, a capability frequently abused by spyware and stalkerware operators to build device fingerprints.
Given the kernel-level severity of multiple CVEs and the active-exploitation potential of the DarkSword web chain, all iPhone and iPad users should treat this update as mandatory.
Users who have not received the automatic prompt can manually trigger the installation via Settings → General → Software Update.
Apple’s decision to force-push this update through Automatic Updates underscores the real-world risk posed by DarkSword and reinforces the company’s position that waiting is not an acceptable response to critical web-based threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
.webp?fit=1600,900&ssl=1&description=Apple has aggressively broadened the deployment of iOS 18.7.7 and iPadOS 18.7.7, pushing the update to millions of additional devices){kind=link}