Apple has issued security updates for older iPhones and iPads, backporting a patch for a CoreGraphics zero-day that the company said had been exploited in highly sophisticated attacks. The move matters for businesses that still rely on older Apple devices for work, especially where smartphones and tablets are used to access email, cloud services, internal documents and business apps.
What happened
According to the reported update, Apple made available security fixes for older iPhone and iPad models after previously addressing the same vulnerability in newer supported versions. The flaw affects CoreGraphics, a core Apple component used to process graphics-related content.
Apple has indicated that the vulnerability was exploited in targeted attacks. Based on the source reporting, these were described as extremely sophisticated attacks, which suggests a limited and focused threat rather than broad mass exploitation. Still, zero-day vulnerabilities are important because they are exploited before many users and organisations have installed a fix.
Why it matters for European businesses
Many SMEs and mid-sized companies continue to use older mobile devices for operational reasons, including longer device refresh cycles, shared field devices, frontline use, testing, and bring-your-own-device arrangements. When security fixes do not reach older hardware, those devices can become a weak point in the company’s wider digital environment.
Even if the reported attacks were targeted, the practical lesson for businesses is broader: mobile endpoints are part of the corporate security perimeter. An exploited iPhone or iPad can expose business email, authentication tokens, contact data, internal files and access to SaaS platforms.
For regulated organisations, mobile device patching also has a governance dimension. Companies subject to GDPR, sector-specific rules or broader cybersecurity obligations are generally expected to apply appropriate technical and organisational measures to protect personal data and business systems. While this update does not create a new legal requirement, it reinforces the need for documented patch management and mobile device security practices.
Who may be affected
- SMEs using older Apple devices for business communication or mobile operations
- IT teams managing mixed fleets of newer and older iPhones and iPads
- Founders and executives who may be higher-value targets in targeted attacks
- Field, sales and service teams relying on mobile access to cloud tools, CRM systems and company email
- Regulated businesses that must maintain stronger security controls and device management records
What companies should consider
- Check device eligibility and patch status. Identify older iPhones and iPads still in use and confirm whether the latest available security update has been installed.
- Review mobile device management policies. If the business uses MDM, verify update enforcement, device visibility and minimum supported OS policies.
- Assess older-device risk. Devices that no longer receive timely security updates may need to be restricted, replaced or removed from access to sensitive systems.
- Prioritise high-risk users. Executives, administrators, finance staff and employees handling sensitive customer or internal data should be patched first.
- Revisit BYOD rules. Companies allowing personal Apple devices for work should confirm minimum OS requirements and define what happens when a device falls behind on security updates.
- Include mobile devices in incident response planning. Security teams should be prepared to isolate or investigate compromised phones and tablets, not just laptops and servers.
For most businesses, this is less about panic and more about hygiene. Apple’s decision to backport the fix to older devices is useful for organisations with longer hardware lifecycles, but it also underlines a recurring security issue: older mobile devices remain operationally convenient, yet they can become a disproportionate risk if patching and lifecycle controls are weak.