India Warns iPhone Users: Here's How to Avoid Major Security Risk

India’s cyber security agency has issued a fresh security advisory urging Apple users to immediately update their devices to the latest software versions, citing a newly identified vulnerability that could allow remote attackers to steal sensitive data.

The Indian Computer Emergency Response Team (CERT-In), the government’s nodal cybersecurity body, released a high-severity alert this month warning that iPhones, iPads, and Mac systems running older software are at risk. The advisory follows Apple’s rollout of iOS 18.6.2, which addresses the flaw, and is a reminder for millions of users to apply the update without delay.

According to CERT-In, the flaw stems from improper bounds checking in Apple’s ImageIO component. A targeted attack could be carried out by tricking users into processing a specially crafted image file, resulting in an out-of-bounds write and possible memory corruption. Security researchers say this creates an opportunity for attackers to execute arbitrary code remotely, potentially giving them access to user data.

The warning applies to the following devices and software versions:

iPhones and iPads running iOS or iPadOS prior to 18.6.2

iPads running iPadOS versions before 17.7.10

Mac devices running macOS Sequoia before 15.6.1

Mac devices running macOS Sonoma before 14.7.8

Mac devices running macOS Ventura before 13.7.8

Apple’s latest patch, released earlier this month, is available for iPhone XS and newer models. However, those testing iOS 26 beta builds will not see the update unless they revert to a stable release. Similar patch updates are available for compatible iPads and Mac devices.

Security experts say the vulnerability is critical and affects devices globally. Users are strongly advised to update their systems immediately through Settings > General > Software Update to reduce the risk of exploitation.

The advisory comes ahead of Apple’s expected iPhone 17 launch next month, but officials stressed that existing users must prioritize their device security rather than waiting for upcoming models.