Old iPhones targeted through patched Safari flaws
13 November 2026 · Mac news
In early November two security reports landed together. They are a useful reminder that a flaw Apple fixed long ago can still be used against a device that never received the fix. On 4 November 2026 the security firm Sekoia published research on a campaign that used old, already-patched Safari and WebKit flaws to steal data from iPhones and Android phones. On 5 November, The Hacker News reported that the US Cybersecurity and Infrastructure Security Agency (CISA) had added one of those Apple flaws, CVE-2024-27834, to its list of vulnerabilities known to be exploited. Apple fixed that flaw in May 2024.
What happened
According to Help Net Security's summary of the Sekoia research, the campaign was first spotted in mid-October 2026. Sekoia links it, with moderate to high confidence, to APT29, a hacking group tied to Russia's foreign intelligence service. The attackers planted code on genuine websites, set up lookalike copies of other sites and, for about a week between late August and early September, hijacked a Ukrainian web analytics script that runs on thousands of websites. One of the lookalike sites copied the page of a luxury hotel in central London.
When someone opened an affected page, a script checked their device and browser version. If the phone was running an old version with known flaws, it was sent an exploit that needed no tap or download from the user. Sekoia describes three exploit chains:
- iPhones on iOS 16.7, attacked with two older flaws, including CVE-2024-27834, to steal browser cookies. Cookies can let an attacker reuse logged-in sessions such as webmail.
- iPhones on iOS 18.5, attacked with a longer chain that could take messages, saved passwords, location data and photos.
- Android phones running older versions of Chrome.
Every flaw used had already been fixed before the campaign began. Help Net Security notes that the payloads did not stay on the phone after sending the data. That is little comfort if your email login or passwords have already gone.
Are Macs affected?
The reported chains targeted phones, not Macs. CVE-2024-27834 itself is in WebKit, the engine behind Safari, and Apple's notes show it was also fixed on the Mac in May 2024 with macOS Sonoma 14.5 and Safari 17.5 for macOS Monterey and Ventura. A Mac that has had normal updates since then is not exposed to this particular flaw. The broader lesson applies to Macs too, though. Attackers reuse public, patched flaws because so many devices stay on old versions, either because nobody pressed Update or because the device is too old to get it.
What to check today
iPhone and iPad
Open Settings, then General, then Software Update. Install anything offered. If it says your software is up to date but the version is old, your device may have reached the end of Apple's major updates. Older iPhones such as the iPhone 8 and iPhone X stopped at iOS 16, although Apple did fix this flaw for them in iOS 16.7.8. They will not get every future fix.
Mac
Open the Apple menu, then System Settings (or System Preferences on older versions), then General, then Software Update. Install the latest version your Mac can run. If you use another browser such as Chrome or Firefox, check that it is updated too. Browsers update separately from macOS.
If you think your accounts may be exposed
Sign out of all sessions in your email account's security settings, change the password and turn on two-factor authentication. That cuts off any stolen cookies.
When a device is too old to update
This is where repair and replacement decisions come in. A phone, iPad or Mac that still gets security updates is usually worth repairing if a screen, battery or charging port fails. One that no longer gets updates is a different matter. It may still be fine for offline jobs, but it should not be your main device for email, banking or browsing. Before spending money on an older device, check which software version it can reach. If it is stuck, put the money towards a replacement instead.
If an older Mac or iPhone has stopped working and the real worry is the photos and documents on it, that is a separate job. Our Mac data recovery service can often get files off a dead machine so you can move them to something current. We also handle iPhone repairs and iPad repairs, and our page on when a Mac is too expensive to repair explains how to weigh that up.
Sources
- Help Net Security: Russian hackers target iOS and Android users with n-day exploits (4 November 2026)
- The Hacker News: Hackers exploit patched Apple flaw to deliver info-stealing malware, CISA says (5 November 2026)
- Apple: About the security content of Safari 17.5 (May 2024)
Get a quote
If you have an older Mac, iPhone or iPad and are not sure whether to repair it, replace it or rescue the files from it, call 020 7394 2525 or visit us at 80 Willow Walk, London SE1 5SY. We are open 9am to 6pm, Monday to Saturday, with bike collection in London and courier collection across the UK.