It was the killer question for millions of iPhone users — has the time finally come when iOS 18 is no longer an option. You must update your iPhone — that is clear. Apple has warned devices are now under attack. But iOS 18.7.3 also fixed the vulnerabilities, and it seemed users would have a choice. But that’s not the case.
The general release of iOS 18.7.3 has now confirmed what many users feared. It is for the “iPhone XS, iPhone XS Max and iPhone XR” only. That means just for phones still eligible for support but not capable of running the newer iOS 26 release.
This is a huge risk. Millions of iPhone users have been holding off upgrading to iOS 26, perhaps given storage or an acute dislike of the new UI, including Liquid Glass. But now is not the time to make a point. Apple’s spyware warnings should make the decision for you. Whatever your views on iOS 26, you can’t miss December’s security update.
Apple’s detailed security notes for iOS 18.7.3 have also changed — the fixes now only show for older devices, not for newer ones eligible for iOS 26. A quick scan of online forums shows users are still determined to hold-out, to stick with the last version of iOS 18 they installed, to avoid the move to iOS 26. This is bad news.
As I’ve warned before. Even if Apple maintained the option to keep newer iPhones on iOS 18, that would be a bad thing to do. The mercenary, commercial spyware threat has never been more acute. And these exploits waterfall down to more threat actors. iOS 26 is newer and safer and more secure. It’s the right choice.
We’re living through Dangerous December. Warnings of ongoing attacks have been issued by Google for Android and Chrome users, in addition to Apple’s alerts. Apple and Google worked together to detect and patch the latest spyware attacks.
Take this seriously.
As Keeper Security’s Darren Guccione told me, “updating is the only effective defense; once patches are public, the exposure window widens for anyone who delays.”
Apple’s exploited vulnerabilities have also prompted America’s cyber defense agency to issue an emergency update warning and mandate federal staff to do so by Jan. 5. So, for those users, even if you did want to hold off updating, you’re simply not allowed. All other users should treat this month’s updates exactly the same way — mandatory.
