.png "Global Insight")
Searches for "iPhone hacked" have spiked to more than 2,000 in the United States this week — and the spike is not about one story. It is about two, arriving days apart, that sound similar but are very different. One is a state-linked spying campaign that used flaws Apple has already fixed. The other is a brand-new flaw, nicknamed "worse_query", that researchers say is still unpatched — and the experts do not agree on whether the latest update fixes it. Here is what each one actually means for the phone in your pocket.
The new flaw: "worse_query"
The newer story starts on November 8, when a security researcher who posts as forcequitOS published code on GitHub for a flaw called worse_query, described as a zero-day sandbox escape for iOS 26 and iOS 27. On November 10, the cryptocurrency exchange Binance warned its users about it, saying the flaw lets a malicious app read local files belonging to other apps. Two days later, 9to5Mac and AppleInsider reported it as an unpatched exploit.
To understand why that matters, you need to know what a sandbox is. On an iPhone, every app lives in its own sealed container — its sandbox — and is not supposed to be able to reach into another app's files. That isolation is the main reason iPhones have a reputation for being hard to hack: even if a bad app gets onto your phone, it should not be able to read your messages, your photos, or the files of your banking or crypto wallet apps. A sandbox escape breaks that wall. According to the reporting, worse_query lets a malicious app read other apps' local files — which is why Binance, whose users hold crypto, raised the alarm: in theory, a wallet app's locally stored data, including seed-phrase material, could be within reach.
The practical details are narrower than the alarm suggests, and they matter. First, the flaw needs a malicious app actually installed on the phone — it does not attack you through a website or a message. On a normal iPhone, apps come through Apple's App Store, where review makes smuggling in a malicious app hard. The route researchers describe runs through sideloaded apps — apps installed from outside the App Store. Second, no theft has been reported. Binance did not report any theft tied to the flaw, the researcher did not either, and BleepingComputer reported no evidence of attackers using it against crypto holders. A developer has even built a legitimate file-browsing tool, WQ Files, on the same technique, without needing a deeper kernel exploit.
Third — and this is where the story gets messy — nobody agrees on whether Apple has already fixed it. Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected; the researcher's notes cover iOS 26.0 through 26.7.2 and iOS 27.2. Apple's release notes for 27.2.1 and 26.7.3 do not mention the flaw at all. The security firm SlowMist's chief said 27.2.1 blocks it. The researcher said it still works on 27.2.1 and on the first beta of iOS 27.3. BleepingComputer contacted Apple for clarification and, according to relayed reporting, no Apple response has surfaced. The honest status, as of today, is unresolved: update to the latest iOS, but do not assume any single version settles the question.
The older campaign: "Poisoned Source"
The second story is older and, in one sense, more serious — but it is also already fixed. On November 4, the French security firm Sekoia published research on a campaign it calls Poisoned Source, which it attributes with moderate to high confidence to APT29, the group widely linked to Russia's Foreign Intelligence Service. The same day, the US Cybersecurity and Infrastructure Security Agency added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalogue, with a November 18 deadline for federal agencies to patch — the catalogue exists for one reason: confirmed, active exploitation in the wild.
Poisoned Source is a watering-hole attack. Instead of targeting victims directly, the attackers compromised websites their targets were likely to visit — several high-profile sites in the United States, Ukraine, the Czech Republic and Bulgaria — and waited. They also set up lookalike domains impersonating real organisations, and between August 27 and September 3 they tampered with the tracking code of Plerdy, a Ukrainian web-analytics service whose snippet many sites embed. A visitor to any of these pages got a small script that checked their phone and browser version, then served an exploit chain matched to it. No download, no extra click.
The chains were aimed at older software. On iPhones running iOS 16.7, one chain used CVE-2024-27834 — a WebKit flaw Apple fixed back in May 2024 — to steal browser cookies. On phones running iOS 18.5, a chain Sekoia calls DarkSword went much further, pulling messages, mail databases, WhatsApp and Telegram data, saved credentials, location information and photographs. A third chain targeted Android phones running Chrome versions 139 to 145, taking Chrome data and Wi-Fi passwords. The crucial point, in Sekoia's own report, is that every flaw used had already been patched — Apple patched the iOS flaws between May 2024 and February 2026, the last of them in iOS 26.3 — and phones updated to the latest system are not affected. The malware also did not establish permanent access: restarting a phone could stop it, though visiting a compromised site again could re-expose an unpatched device.
One more claim, still unverified
There is a third thread worth mentioning precisely because it is not yet proven. On November 3, a research team calling itself Calif posted a video claiming to have run an exploit on an iPhone 18 Pro with Lockdown Mode turned on — Apple's hardened protection mode for a small number of high-risk users. As of November 8, only the video had been released, with no technical details, and no response or fix from Apple had been found. A video is not proof, and until technical details or independent confirmation appear, this one stays in the "claimed, not confirmed" column.
What to do now
The two stories point to the same short checklist, and it is reassuringly boring. First, update your iPhone to the latest iOS — that alone closes the Poisoned Source chains entirely, and it is the best available move on worse_query while its patch status is disputed. Second, do not sideload apps from outside the App Store, and delete any app you do not recognise. Third, restart your phone occasionally; it clears non-persistent malware of the kind Poisoned Source used. Fourth, if you hold crypto on your phone, check whether your wallet app stores a seed phrase locally and consider a hardware wallet for large holdings — not because a theft has happened, but because worse_query is exactly the kind of flaw that would target one.
The lesson of this week is not that iPhones are suddenly unsafe. It is that the two words in "iPhone hacked" hide two very different risks: a sophisticated campaign against outdated phones that updating defeats completely, and a new flaw whose danger depends almost entirely on whether you install apps from outside Apple's store. One of those you have already fixed by updating. The other you fix by being careful about what you install — and by watching for Apple's answer on whether 27.2.1 really closes it.