How Long Does an iPhone Get Security Updates?

Search for "how long does an iPhone get security updates" and you'll mostly find guesses: five years, seven years, "about five iOS versions." Apple has never published an official support-length policy, so writers extrapolate. This page doesn't. It reads Apple's own software-availability feed, the public endpoint at gdmf.apple.com/v2/pmv that Apple's own update system uses to decide what to offer your phone, checked on 27 September 2026. That feed lists, build by build, exactly what Apple is shipping right now — and it's more generous, and more specific, than almost anything else written on this topic.

New iOS versions and security updates run on different clocks

The confusion starts with a reasonable assumption: once your iPhone stops appearing in the list of devices that get the newest iOS, it must be done getting updates entirely. That's wrong, and checkably so. Apple runs two separate tracks. The one everyone watches is the yearly major release — iOS 26 this year, iOS 27 now shipped as the current release, iOS 28 projected for 2027. Eligibility ends abruptly: your phone is on the supported list for the new major version, or it isn't.

The second track gets almost no coverage: once a device is dropped from the major-version track, Apple typically keeps a maintenance branch open at that device's last supported major version and keeps shipping security-only fixes to it — no new features, no exciting version number, just patches on Apple's regular security cadence rather than the yearly keynote cycle. That second track is what actually determines how long a phone stays safe, and it's what this page is built around. If your iPhone was dropped by a recent release, don't assume you're already unprotected — check whether small point updates are still arriving. The table below shows exactly which iPhones sit on which branch, and how recently each was patched.

The evidence: seven iOS branches, all currently offered

This is the core of the page. As of the 27 September 2026 check, Apple's feed lists seven iOS branches it's currently offering — six to iPhones, one iPad-only. This table originally listed iOS 26.6.1 (23G83) as the newest iPhone branch; iOS 27.0 (24A437) shipped 14 September 2026, exactly on the date this site had projected, and is now the current release, with iOS 26.7 (23H24) offered alongside it as a stay-on-26 option. Every row below is a branch Apple is actively offering today, not a historical artifact.

Read across that table and a pattern jumps out: Apple isn't maintaining just one current iOS and letting everything else go quiet — it's actively offering seven branches side by side, one of them exclusively for iPads. One caveat on how we read this table now versus how we used to: Apple's feed also carries a PostingDate for each build, and an earlier version of this page treated that date as when a branch was patched. It isn't — PostingDate is when the feed last (re)listed a build, and it can change with no new patch behind it. We no longer use it to claim builds went out "the same week"; see "How we got this data" below for the full correction. What the table does show reliably is that Apple keeps old branches actively offered for years after the devices on them stop getting new iOS versions, in parallel with active development on the current release. Whatever Apple's internal policy actually is, it clearly isn't "stop patching once a device misses the new major version."

The feed also lists non-iPhone hardware sharing several branches: iOS 27.0 also covers additional iPad models, iOS 12.5.8 also serves 9 iPads and 1 iPod touch, and iOS 15.8.8 also serves 4 iPads and 1 iPod touch. If you're checking compatibility for iOS 28 rather than looking backward, the current lineup lives on our supported devices page, with a per-model check on the compatibility checker.

The number that started this page: a 2013 iPhone, patched in 2026

One line here deserves to be said plainly rather than buried in a table cell: the iPhone 5s launched in September 2013, and Apple's update system is still offering it security patches today — iOS 12.5.8, build 16H88 — as of September 2026. That's not a rounding error. It's a maintenance branch Apple has kept alive for a phone approaching its thirteenth birthday, even though the exact date that build itself was released isn't published in the feed we checked.

The iPhone 5s stopped getting new iOS versions when iOS 13 shipped in 2019, excluded from that release and every one since. Tracking major-version eligibility alone, you'd have written this phone off as unsupported in 2019. Instead, seven years later, Apple is still closing security holes on it. That gap — between "stopped getting new iOS" and "stopped getting patched" — is the entire subject of this page, and the 5s is its clearest example.

How a maintenance branch works, and how to recognize you're on one

The mechanism is simpler than it looks. When Apple ships a new major iOS version, some older devices are excluded — usually because the release needs hardware capabilities (a newer chip, more memory, a required security feature) those devices lack. Apple doesn't stop developing for the excluded devices immediately: it forks a maintenance branch at the version they were last running and continues backporting tested security fixes to it, in parallel with active development on the current major version.

That's exactly what the six-branch table shows. iOS 13 dropped the iPhone 5s, 6, and 6 Plus onto the iOS 12 branch, now at 12.5.8. iOS 16 dropped the 6s, 6s Plus, 7, 7 Plus, and first-gen SE onto the iOS 15 branch, now at 15.8.8. iOS 17 dropped the 8, 8 Plus, and X onto the iOS 16 branch, now at 16.7.16. iOS 26 dropped the XS, XS Max, and XR onto the iOS 18 branch, now at 18.7.10. Every row in the table is a snapshot of one of these cutoff events, still being actively patched.

You can recognize this on your own phone without reading Apple's release notes. If your iPhone stopped being offered a jump to the newest whole-number iOS version, but Settings still periodically offers a small update — the last digit climbing (18.7.9 to 18.7.10, say) rather than the version number itself changing — that small update is the maintenance-branch patch. It looks unremarkable on purpose: no new icon, no feature list, just a quietly closed vulnerability. Our build number explainer breaks down what a string like 22H374 actually encodes.

The one branch with no iPhones on it

One row stands out for a different reason: iOS 17.7.11 currently has zero iPhones on it. It's a real, currently offered branch, but it exists purely for six iPad models, with no iPhone anywhere in its device list. That breaks the pattern every other row follows, and it's worth explaining.

Here's the honest read, working strictly from what the branch table itself shows. Trace the iPhone cutoffs and there's no gap at iOS 17: that release dropped the 8, 8 Plus, and X, and they needed a home on the branch below it — iOS 16.7.16, exactly where they sit. No iPhone's support window ends at the last version of iOS 17 itself, because no iPhone was dropped by iOS 18 — every phone that qualified for 17 also qualified for 18, and the next iPhone cutoff didn't come until iOS 26 dropped the XS family onto the iOS 18 branch. Going purely by the pattern, no iPhone generation ever needed the iOS 17 branch.

iPadOS has increasingly diverged from iOS in which hardware generations it drops and when, especially since it became its own numbered platform. It's reasonable to infer some iPad models had their support window end while iOS 17 was current, even though the matching iPhone lineup saw no cutoff that year. That's a plausible read built directly from the data, not something Apple states outright — it doesn't publish the reasoning behind why a branch exists for one platform and not another, so treat this as informed inference rather than a confirmed mechanism.

What a security-only branch doesn't give you

This is the section that matters most if you're deciding whether an older iPhone is fine to keep using, and the part most "how long do iPhones get updates" articles skip. Being patched and being current are not the same thing. A maintenance branch buys real protection against the specific vulnerabilities Apple has fixed on it — that's genuine. But it's deliberately narrow, with real consequences:

• No new features, ever. A maintenance branch is frozen at its major version's feature set permanently. The iPhone 5s on iOS 12.5.8 will never see anything from iOS 13 through 26 — Apple backports fixes serious enough to warrant it, not capabilities.
• No new Safari engine capabilities. The web moves independently of iOS's release cycle. A phone stuck on an old WebKit build increasingly can't render modern sites correctly, and that gap widens every year the branch stays frozen, even while it keeps getting patched.
• App compatibility erodes regardless of Apple's patching. Developers set a minimum supported iOS version for their own reasons — new APIs, dropped legacy support — and that minimum climbs independent of whether Apple is still patching your OS. A banking or retailer app can simply stop supporting your iOS version, security patches or not.
• No new anti-fraud or platform-level protections. Some meaningful security improvements aren't backported at all — they're new capabilities introduced with a major release, available only going forward.

Put together: a well-maintained old iPhone is safer than an unpatched one, full stop, but "still getting security patches" and "fully current" are different claims. If you're weighing the beta track instead, the same principle applies there — beta builds carry current security fixes, as covered in our beta safety guide — even though stability is a separate question.

If your iPhone is about to miss iOS 28

iOS 28 is a 2027 projection, not a confirmed lineup — the site's working stance is that iPhone 13 and newer should be expected to qualify, with iPhone 12 support genuinely uncertain. If your phone lands on the wrong side of that line, the pattern on this page is the most useful thing to carry into that decision: being dropped by iOS 28 would not mean your phone goes unpatched the next day. Going by how every cutoff in the table above has played out, a device dropped by iOS 28 would most likely land on a maintenance branch at its last major version and keep receiving security-only updates for a meaningful stretch afterward — quite possibly years, judging by how the iOS 18, 16, 15, and 12 branches have all held up.

Practically: don't panic-upgrade the day iOS 28 eligibility is announced, and don't treat a missed major version as a hard safety deadline. Watch the real signal — whether Settings keeps offering small point updates on your current major version — and treat app compatibility, not a rumored cutoff date, as your actual forcing function for replacing the device. For the two borderline cases, see iPhone 12 and iOS 28 and iPhone 13 and iOS 28; the full current lineup is on the iOS 27 supported devices page.

How we got this data

Everything in the branch table comes directly from Apple's own software-availability feed at gdmf.apple.com/v2/pmv — the same public endpoint Apple's software-update system queries to decide what to offer a given device. It lists every iOS branch Apple is currently serving, the exact build number, and the device model identifiers eligible for it. We checked this feed on 27 September 2026 and mapped each identifier to its retail model name using only verified, publicly documented mappings; where a mapping wasn't independently confirmable, we described the range in prose instead of guessing. Correction: an earlier version of this page said the iPhone 5s "received a security update — iOS 12.5.8, build 16H88 — on 24 August 2026." That was a mistake: the date came from the feed's PostingDate field, which marks when Apple's feed last (re)listed a build, not when that build was actually released — the same build 16H88 later showed a different PostingDate with no new patch behind it. We've corrected every instance of that error on this page and no longer treat PostingDate as a release date. Nothing here is sourced from rumor sites or forum reports — it's a direct read of Apple's own infrastructure, which is also why it can change: Apple updates this feed with every new build, and a branch active today isn't guaranteed to stay active indefinitely.

The bottom line

There's no fixed number Apple has ever committed to — but the observable pattern, read straight from Apple's own feed, is generous: multiple years of security-only patching after a device stops getting new iOS versions, and in the most extreme case currently visible, close to thirteen years and counting for the iPhone 5s. That's real. The honest caveat is that patched isn't the same as current — a security-only branch closes known vulnerabilities without ever adding a feature, a new Safari capability, or a guarantee that your apps keep working. Deciding whether to keep an old iPhone running, or planning around iOS 28 eligibility, should rest on that distinction — not a mythical cutoff date.

Common questions