Apple releases iOS 15.8.5 security update for 10-year old iPhone 6s

One key thing I noticed is this is before iPadOS was a thing, so this patch targets iPads too... Which makes me wonder... this is speculation no proof, but I wonder if someone is exploiting Point of Sale devices that are powered by old iPads somehow, which is out of the control of a lot of end-users who are at thee mercy of the POS vendors who are probably charging an insane premium on them.

I worked at a restaurant chain and I remember it being a whole thing to even consider reworking the POS tables + software due to rising costs.

> What’s Apple’s default time frame for security support?

This isn't thaaaaat far out of support. Their last security update for iOS 15 was just earlier this year, and they only dropped iPhone 6s from new major versions with iOS 16 a few years ago. As someone who has kept my last few iPhones for 5+ years each, I definitely appreciate that they keep a much longer support window than most folks on the Android side of things.

I think their minimum standard is 5 years after they stop selling a product. However, it could go longer if things still work.

The 6S was discontinued in 2018, which would give it support until at least 2023, so we aren’t too far beyond that.

> is it fair to say this kind of backdated security patch implies a lot about the severity of the vulnerability?

That is my assumption, that the result is a pretty severe impact and/or the victim has little to no way to prevent it (zero click situation).

Granted I can't speak for Apple, but I was thinking along the same lines you were.

No specific timeframe is defined, but they tend to release things that matter really far back — like, the Apple CA certificate expiration update went out a few years ago to basically the entire deployed Square terminal iPad userbase, etc. I expect it’s driven by telemetry and threat model both. Presumably the cutoff is wherever the telemetry ceases!

Almost certainly some kind of zero click/zero user action RCE exploit.

Edit: I should've read, "Impact: Processing a malicious image file may result in memory corruption."

So simply receiving an image via SMS or loading it in some other way likely accomplishes the initial exploit, so yeah, zero click exploit. Always bad.

This specific vulnerability was already known and exploited - and patched by Apple - three weeks ago on devices that Apple deemed "current".

I got plenty of old iPhones I can still use.

My pile of old android phones ... they sadly do not live long overall as far as a % of survivors goes. A few have lived long lives for sure, but overall not as many as my old iPhones.