The need for Apple users to reboot their iPhones continues to make headlines (1,2), albeit the reasons behind this are less well understood. This is not just an alarming new attack that has caused chaos across the iWorld. This is an alarming number of iPhone users that have not installed security fixes that Apple released a full 6 weeks ago.
Let’s be very clear. Apple issued fixes in mid-December and warned users to update. For that 6 week period, iPhones not updating have not been secure. That changes the nature of those devices and undermines the reason to buy an iPhone in the first place.
The actual number of affected users is unclear. Some analysts suggest more than half of all iPhones, but that is overstated. The number is material. Likely hundreds of millions of devices, even when using more balanced market share metrics.
In December, Apple warned that iPhones are under attack from two exploits to its WebKit software. These started as “extremely sophisticated attacks against specific targeted individuals.” But security analysts quickly warned that WebKit vulnerabilities are especially dangerous, and will leak out to less sophisticated attackers.
Apple’s decision to withhold an iOS 18 update in December for any iPhones able to run iOS 26 also means those hundreds of millions of devices have likely not restarted. And they won’t, not until users do so manually or finally device to upgrade to iOS 26.
While many security agencies advise users to restart phones regularly — as often as weekly. Very few users do that. And in reality, if you don’t restart your iPhone regularly, you’re unlikely to be caught out. That’s not to say it’s not good practice — it is.
That combination of active attacks and Apple’s decision to force users to upgrade to iOS 26 resulted in a unique combination of factors that make it more critical to restart your iPhone. And to do so regularly until you do eventually upgrade to iOS 26.
It’s not just the WebKit flaws that matter. Apple included more than 25 security fixes in iOS 26.2, any of which could affect your device. And Apple is unlikely to warn if any of those are exploited now they’re public domain. It has issued fixes. The vulnerabilities have been closed. Users are uniquely choosing to ignore those fixes en masse.
The best advice — update now, don’t even wait for iOS 26.3 which is imminent. That way you get the fixes and the restart at the same time. And your iPhone is secure.
Those 6 weeks is long enough. Don’t leave it any longer.
