How to protect your iPhone from hacking: settings and common questions

On 4 November the US cyber agency CISA added an Apple bug, CVE-2024-27834, to its list of vulnerabilities that attackers exploit in real attacks. Apple fixed it in 2024. In September Apple patched a CoreGraphics flaw, CVE-2026-86950, and said it “may have been exploited in an extremely sophisticated attack against specific targeted individuals.” Both cases point to the same first step if you want to protect your iPhone from hacking: install the update.

Update first

Apple’s security releases page lists the current versions:

• iOS 27.2, released on 26 October, for iPhone 11 and later;
• iOS 26.7.2 for those who stayed on iOS 26;
• iOS 18.7.11 for iPhone XS, XS Max and XR.

iOS 27.2 alone fixed 163 vulnerabilities. Turn on automatic updates in Settings, General, Software Update.

Stolen Device Protection

A thief who watches you type your passcode can change your Apple Account password and lock you out. Stolen Device Protection closes that gap. Away from home or work, your iPhone asks for Face ID or Touch ID to open saved passwords, with no passcode fallback. To change the Apple Account password, it makes you wait an hour and scan your face again.

It works on iOS 17.3 and later and needs Find My turned on. You must enable it before the phone goes missing: Settings, Face ID & Passcode, Stolen Device Protection. Use a six-digit or alphanumeric passcode, and enter it out of strangers’ sight.

Apple Account and iCloud

Use two-factor authentication and a strong password for your Apple Account, Apple recommends. Never read a verification code to anyone who calls. Apple says its threat notifications “never ask” for a password or verification code by email or phone, so a caller who asks is not Apple.

Standard iCloud protection end-to-end encrypts 15 data categories, including Health and passwords. Advanced Data Protection raises that to 25 and adds iCloud Backup, Photos and Notes. Apple then holds no keys for them, so set up a recovery contact or recovery key first.

Lockdown Mode for targeted people

Lockdown Mode is for people whom someone may target personally: journalists, activists, executives, large crypto holders. It blocks most message attachments and link previews, cuts FaceTime calls from people you have not called in 30 days, turns off 2G and 3G, and requires an unlocked phone to connect accessories. Some websites may load slowly or break. Apple calls it “extreme protection” and says most people never face such attacks.

Frequently asked questions

Can someone hack an iPhone through a message? Yes, in rare targeted attacks. CVE-2026-86950 needed only a “maliciously crafted file”. Updates close such holes, and Lockdown Mode blocks most attachment types.

How do I know someone targeted me? Apple sends threat notifications when it detects mercenary spyware. Since 2021 it has warned users in more than 150 countries: an alert on the Lock Screen, an email from threat-notifications@email.apple.com and a banner on account.apple.com. Check there, never through a link in a message.

My iPhone is old. Am I safe? The iPhone XS and XR still get fixes in iOS 18.7.11. Older models no longer appear in Apple’s security releases, so do not keep a wallet or banking apps on them.

Should I install a configuration profile someone sent me? No. A profile can route your traffic through someone else’s server. Install profiles only from your employer or school.

What about my crypto wallet? Do not store a seed phrase in Notes, Photos or iCloud. In October a user blamed spyware for $68,000 leaving his Trust Wallet, although Apple had patched the exploit chain 205 days earlier. Our wallet guide covers the other ways in.

What to do today

If you do only two things today, open Software Update and turn on Stolen Device Protection. You will find both in the Settings app.

Based on Apple support pages on security releases, Stolen Device Protection, Lockdown Mode, iCloud data security and threat notifications, and the CISA Known Exploited Vulnerabilities catalog, checked on 9 November 2026.