iPhone
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Cyber Security NewsOlder iPhones storing crypto seed phrases face physical BootROM attack risk
- Vulnerability reported by GBHackersUnpatchable BootROM flaws in older iPhones put crypto wallet recovery phrases at risk
- Malware reported by Cyber Security NewsApple sends new mercenary spyware threat notifications to iPhone users in 99 countries
- Vulnerability reported by Cyber Security NewsZero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
Recent news
Older iPhones storing crypto seed phrases face physical BootROM attack risk
Researchers disclosed the usbliter8 BootROM exploit in June 2026, which extends checkm8-style attacks to Apple's A12 and A13 chips, including the iPhone XS, XR, iPhone 11 family and second-generation iPhone SE. An attacker with physical access and cheap USB hardware can run unsigned code before iOS loads, but the Secure Enclave is not directly compromised, so wallet theft would need further weaknesses. OneKey founder Yishi warns that wiping and offlining an old iPhone does not make it a secure cold wallet.
Unpatchable BootROM flaws in older iPhones put crypto wallet recovery phrases at risk
Older iPhones contain unpatchable BootROM vulnerabilities, so the risk persists even after a device is wiped and kept in airplane mode. An attacker needs physical access, and exploiting the flaw does not automatically expose encrypted wallet data, though other weaknesses could potentially be used to do so.
Weekly roundup: Binance theft, Chrome and Firefox fixes, and Homeland Security data leak
The roundup covers a reported $6.3 billion crypto theft from Binance, described as the largest ever, and a breach in which hackers stole and published data on 41,000 Homeland Security workers. Other items include fake PDF and search tools that hijacked searches for 13.4 million Chrome users, malicious Firefox extensions impersonating crypto wallets, and a Quest breach exposing patient records. It also flags Chrome and Firefox security updates, an Apple update for older iPhones and iPads, and concerns about Samsung TVs and Popcorn Time's forgotten updater. The article gives headlines only, so technical details must come from the linked original reports.
Apple sends new mercenary spyware threat notifications to iPhone users in 99 countries
Apple has issued a new wave of threat notifications to selected iPhone users in 99 countries, reported by researcher Costin Raiu on 30 October 2026 and separate from the August alerts that covered 110 countries. Apple says more than 150 countries have been notified in total, but these figures refer to user locations, not confirmed infections. Apple has not named the attackers, the spyware product or any software flaw involved.
Zero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
A zero-click Android flaw dubbed 'SMS of Death' lets an attacker crash the com.android.phone process with one malformed WAP Push message, dropping active calls and causing one to two seconds without service per message. Around 30 messages in quick succession can corrupt the SMS SQLite database, leaving the phone app crashing on every boot, and carrier retries of unacknowledged messages can re-trigger the problem after a factory reset. Google has marked the report 'Won't Fix' as a non-security issue, according to the researcher's disclosure site.