Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits

On 27 March 2026, Apple began sending Lock Screen alerts to iPhones and iPads running older iOS and iPadOS versions to warn users about active web-based exploits, urging them to update. According to MacRumors, the notifications state: “Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone.

Install this critical update to protect your iPhone.” The move follows Apple’s release of a support document about exploit kits such as Coruna and DarkSword, which have been used by multiple threat actors over the past year. Coruna targets iOS versions 13.0 to 17.2.1, while DarkSword targets 18.4 to 18.7, and researchers have described Coruna as an evolution of the Operation Triangulation framework.

For users unable to update, Apple suggests enabling Lockdown Mode where available, with Apple stating they are not aware of any mercenary spyware attacks against Lockdown Mode-enabled devices.