Your old iPhone might have a security vulnerability that Apple is unable to resolve.
Security researchers have discovered a new BootROM exploit that impacts iPhones equipped with A12 and A13 chips.
Apple iPhone 11 Pro
Andy Boxall / Digital Trends
iPhones are generally regarded as some of the most secure smartphones for everyday users. However, Apple devices are not free from serious security vulnerabilities, as recent threats like Coruna and DarkSword have demonstrated. Security researchers at Paradigm Shift have now detailed a new exploit called usbliter8, which affects certain older iPhones and targets a critical part of Apple's startup process known as the BootROM.
The BootROM is the fundamental startup code that runs before iOS is loaded. It helps the iPhone initiate the boot process and confirm what should execute next. Since it is embedded in the chip, fixing it is significantly more challenging than addressing a typical iOS bug. While Apple can usually address software vulnerabilities with updates, it cannot alter BootROM code on devices already in circulation.
How does the exploit function?
According to the researchers, usbliter8 exploits a flaw in the iPhone's USB hardware and the way some older Apple chips manage USB data during startup. In straightforward terms, an attacker could send specially crafted USB data while the device is booting up or in restore mode. This could confuse the USB controller and lead to data being written to incorrect locations in memory. Consequently, the exploit can disrupt the boot process and execute unauthorized code before iOS has fully loaded.
Julian Chokkattu / Digital Trends
Although this sounds serious, there is a significant limitation. This is not a remote attack that can compromise your iPhone via a website, text message, or app. It necessitates USB access, meaning the iPhone would need to be connected to a computer or another USB device.
Which iPhones are affected?
The exploit impacts devices using A12 and A13 chips, as well as Apple's S4 and S5 smartwatch chips. For iPhone users, this includes the iPhone XR, iPhone XS, iPhone XS Max, iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, and the second-generation iPhone SE. Apple Watch models affected by this include the Apple Watch Series 4, Series 5, and the first-generation Apple Watch SE. Researchers note that executing the exploit is more complicated on devices with A13 chips.
Andy Boxall / Digital Trends
Since this is a hardware-level issue, there is no standard software update that can completely eliminate the risk. It's advisable to avoid connecting older iPhones or Apple Watches to unfamiliar computers, public USB ports, or untrusted accessories. If you own one of the affected models and prioritize security, upgrading to a newer device may provide greater peace of mind.
I have approximately four years of experience, mainly covering gaming, PC hardware, and smartphones. In my spare time, I enjoy…
I have tested many features of iOS 27, and these three are why I'm still enthusiastic about the update.
It has been just over a week since Apple's WWDC keynote, and the iOS 27 beta is already available. While Apple spent considerable time discussing its Gemini-powered Siri, what excited me the most was the chance to install the update on my iPhone 16e and see what it would be like to use.
Since then, I've been using the beta daily, and one thing has become clear: not every new feature lived up to the hype for me. Some seemed more intriguing during the announcement than they actually are in everyday use, while others simply haven’t fit into my routine. However, a few features have been the complete opposite. These are the ones I've continuously returned to without thinking about it. After more than a week with iOS 27, here are the three features that have stood out the most — and the primary reason I'm still excited about this update.
Read more
Did you know your iPhone displays fireworks on screen when you call someone on their birthday?
Not every treasure in iOS 27 was highlighted during the keynote. This one is definitely worth discovering.
Apple has included numerous small features in iOS 27 that went unmentioned at WWDC 2026, but this particular one might be the most delightful find yet. If you call someone on their birthday while using iOS 27, it subtly shows a fireworks animation on the call screen. I verified this by setting my sister's birthday to today, June 20, 2026, in a beta version of iOS 27, and it worked perfectly.
Read more
Caviar’s iPhone case is three times more expensive than the phone itself and features a real T-Rex tooth fragment.
Caviar has previously created many extravagantly priced custom phones, but its latest accessory for the iPhone is something truly unique. The new Magnetic Custom Relict case for the iPhone 17 Pro Max retails for $4,490. While the price seems outrageous, it makes sense once you see
Other articles
Ubisoft co-founder Claude Guillemot has passed away at the age of 69 in a plane crash near La Baule.
Claude Guillemot, a co-founder of Ubisoft in 1986 and former leader of Guillemot Corp, has passed away in a crash involving a Cessna 421 in western France.
Sony's innovative PSN login patent may transform the DualSense into a security gatekeeper.
Sony's patent for PSN login might integrate the DualSense controller into the account access process, but the more significant security challenge could still be the account recovery procedure for PlayStation.
Harvard Business Review cautions that AI 'workslop' is undermining organizations from within.
HBR reports that excessive dependence on AI is leading to "knowledge decay," as subpar results undermine trust, result in wasted rework hours, and diminish the quality of decision-making.
Ubisoft co-founder Claude Guillemot has passed away at the age of 69 in a plane crash close to La Baule.
Claude Guillemot, co-founder of Ubisoft in 1986 and head of gaming peripherals company Guillemot Corp, has passed away in a Cessna 421 accident in western France.
Hackers are widely exploiting a Gravity SMTP vulnerability to extract API keys from 100,000 WordPress websites.
Wordfence has intercepted over 17 million exploitation attempts aimed at a Gravity SMTP vulnerability that exposes API keys, OAuth tokens, and complete system reports without the need for authentication.
Jio Platforms has submitted a request for India's largest IPO to date, planning to allocate nearly $3 billion for the repayment of debts.
Jio Platforms has submitted its Draft Red Herring Prospectus (DRHP) to SEBI for a new share issuance valued at $3.8 billion, with $2.9 billion earmarked for repaying loans to its telecom unit from ANZ, BofA, Barclays, and other financial institutions.
Your old iPhone might have a security vulnerability that Apple is unable to resolve.
A new vulnerability named usbliter8 impacts certain older iPhones and Apple Watches. It necessitates USB access and focuses on a fundamental hardware-level segment of Apple’s startup procedure.