{"id":65679,"date":"2026-03-24T01:28:33","date_gmt":"2026-03-24T00:28:33","guid":{"rendered":"https:\/\/www.apfelpatient.de\/?p=65679"},"modified":"2026-03-24T01:30:11","modified_gmt":"2026-03-24T00:30:11","slug":"ios-update-important-darksword-exploit-available-online","status":"publish","type":"post","link":"https:\/\/www.apfelpatient.de\/en\/news\/ios-update-wichtig-darksword-exploit-online-verfuegbar","title":{"rendered":"Important iOS Update: DarkSword exploit available online"},"content":{"rendered":"

A dangerous iOS exploit is currently attracting attention after the associated code was made public. Dubbed DarkSword, this attack tool specifically targets security vulnerabilities in certain iOS versions. Although Apple has already patched the vulnerabilities, the situation remains critical because many devices have not yet been updated.<\/strong><\/p>\n\n\n\n

The release of exploit code is not a new phenomenon, but in this case, the implications are particularly significant. Previously, another tool called Coruna<\/a>, possibly developed by a US government agency, was circulating. Now, DarkSword<\/a> is another exploit that no longer exists in secret but is publicly available on GitHub.<\/p>\n\n\n\n

This significantly changes the initial situation. Tools that were originally accessible only to a few players can now be used by a wider audience. Particularly in connection with iOS, this creates a concrete risk for devices that are not up to date.<\/p>\n\n\n\n

What is the DarkSword exploit?<\/h4>\n\n\n\n

DarkSword is an exploit primarily targeting iOS versions between 18.4 and 18.7. However, older versions of iOS are also vulnerable to the exploited flaws.<\/p>\n\n\n\n

The attack begins via Safari or the WebKit engine. Code is executed on the device through these entry points. The exploit then uses several vulnerabilities to bypass iOS's sandbox protection mechanisms.<\/p>\n\n\n\n

After successful exploitation, an attacker can completely compromise an iPhone or iPad. This means comprehensive access to system functions and stored data.<\/p>\n\n\n\n

Publishing on GitHub increases the risk<\/h4>\n\n\n\n

The crucial point in this case is public availability. The DarkSword code has been uploaded to GitHub and is therefore freely accessible.<\/p>\n\n\n\n

According to a TechCrunch<\/a> report, the version published there is relatively easy to use. This means that no in-depth knowledge of iOS is required to use the exploit.<\/p>\n\n\n\n

Matthias Frielingsdorf, co-founder of the security company iVerify, describes the situation as serious. In his estimation, the exploits work immediately and without any special prior knowledge. At the same time, he assumes that criminals and other actors will begin to actively exploit these possibilities.<\/p>\n\n\n\n

A Google spokesperson shares this assessment. The combination of ease of use and public availability significantly increases the likelihood of actual attacks.<\/p>\n\n\n\n

What data can be accessed<\/h4>\n\n\n\n

The version published on GitHub contains not only the exploit itself, but also developer notes. These describe in detail how the attack works and what features it includes.<\/p>\n\n\n\n

DarkSword is described as a tool that can read and exfiltrate forensically relevant files from iOS devices via HTTP.<\/p>\n\n\n\n

Another section of the code deals with the activities following successful exploitation. It documents the entire process by which data is collected and transmitted. The data affected includes, among other things:<\/p>\n\n\n\n