Apple has officially expanded the rollout of iOS 18.7.7 and iPadOS 18.7.7 to defend users against a critical web-based threat known as the DarkSword exploit.
Originally released on March 24, 2026, Apple aggressively pushed the update to more devices via Automatic Updates on April 1 to ensure widespread, immediate protection.
The DarkSword Threat
While the foundational fixes for the DarkSword exploit first shipped in 2025, this latest update brings mandatory web attack protections to all supported devices.
Because DarkSword relies on malicious web content to compromise systems, ensuring that all active users have these latest security definitions is critical.
The update covers a wide hardware range, supporting devices as old as the iPhone XR up through the latest iPhone 16 lineup, as well as multiple generations of iPads.
Critical Vulnerabilities Patched
Beyond the DarkSword protections, iOS 18.7.7 addresses over 15 significant security flaws.
These patches close critical gaps that could allow threat actors to access sensitive data, track user behavior, or execute unauthorized code.
Here is a breakdown of the most severe vulnerabilities addressed in this release:
| Component | CVE Identifier | Impact | Description |
|---|---|---|---|
| Kernel | CVE-2026-20687 | System crash or unauthorized kernel memory writing. | Resolved a severe use-after-free memory issue. |
| WebKit | CVE-2026-20643 | Bypassing the Same Origin Policy via web attacks. | Fixed a cross-origin logic issue in the Navigation API. |
| Security | CVE-2026-28864 | Local attackers gaining access to Keychain items. | Improved permissions checking to lock down credentials. |
| Clipboard | CVE-2026-28866 | Apps secretly accessing sensitive copied user data. | Enhanced symlink validation to prevent unauthorized access. |
| Network | CVE-2026-28865 | Intercepting network traffic from a privileged position. | Fixed an 802.1X authentication state management issue. |
Apple also focused heavily on user privacy in this patch cycle. A notable WebKit bug (CVE-2025-43376) was resolved, which previously allowed remote attackers to view leaked DNS queries even when iCloud Private Relay was turned on.
Additionally, Apple patched permission issues in iCloud and Crash Reporter (CVE-2026-28880 and CVE-2026-28878) that allowed rogue apps to secretly scan and enumerate other applications installed on a user’s device.
Given the severity of the DarkSword web attacks and the underlying kernel-level vulnerabilities, all Apple users are strongly advised to update their devices immediately.
Users can navigate to Settings > General > Software Update to manually trigger the installation if their device has not already applied the patch automatically.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
