How Long Does an iPhone Get Security Updates?

Search for "how long does an iPhone get security updates" and you'll mostly find guesses: five years, seven years, "about five iOS versions." Apple has never published an official support-length policy, so writers extrapolate. This page doesn't. It reads Apple's own software-availability feed, the public endpoint at gdmf.apple.com/v2/pmv that Apple's own update system uses to decide what to offer your phone, checked on 2 September 2026. That feed lists, build by build, exactly what Apple is shipping right now — and it's more generous, and more specific, than almost anything else written on this topic.

New iOS versions and security updates run on different clocks

The confusion starts with a reasonable assumption: once your iPhone stops appearing in the list of devices that get the newest iOS, it must be done getting updates entirely. That's wrong, and checkably so. Apple runs two separate tracks. The one everyone watches is the yearly major release — iOS 26 this year, iOS 27 arriving as a developer beta now, iOS 28 projected for 2027. Eligibility ends abruptly: your phone is on the supported list for the new major version, or it isn't.

The second track gets almost no coverage: once a device is dropped from the major-version track, Apple typically keeps a maintenance branch open at that device's last supported major version and keeps shipping security-only fixes to it — no new features, no exciting version number, just patches on Apple's regular security cadence rather than the yearly keynote cycle. That second track is what actually determines how long a phone stays safe, and it's what this page is built around. If your iPhone was dropped by a recent release, don't assume you're already unprotected — check whether small point updates are still arriving. The table below shows exactly which iPhones sit on which branch, and how recently each was patched.

The evidence: six iOS branches, all patched the same week

This is the core of the page. As of the 2 September 2026 check, Apple's feed lists six iOS branches receiving updates at once — five posted the exact same date, 24 August 2026. Every row below is a live, currently maintained branch, not a historical artifact.

Read across that table and a pattern jumps out: five of the six rows carry the exact same posted date. Apple didn't patch one old branch as an afterthought this month — it patched essentially all of them, in the same cycle, as routine maintenance. That's what a normal week looks like on Apple's update infrastructure, not a one-off this page happened to catch. The pattern isn't unique to iPhone, either: the same feed shows watchOS currently maintaining six of its own branches (5.3.10, 6.3.1, 8.8.2, 9.6.4, 10.6.2, and 11.6.2), last posted 27 July 2026. Whatever Apple's internal policy actually is, it clearly isn't "stop patching once a device misses the new major version."

The feed also lists non-iPhone hardware sharing several branches: iOS 26.6.1 additionally covers 64 iPad models, iOS 12.5.8 also serves 9 iPads and 1 iPod touch, and iOS 15.8.8 also serves 4 iPads and 1 iPod touch. If you're checking compatibility for iOS 28 rather than looking backward, the current lineup lives on our supported devices page, with a per-model check on the compatibility checker.

The number that started this page: a 2013 iPhone, patched in 2026

One line here deserves to be said plainly rather than buried in a table cell: the iPhone 5s launched in September 2013, and it received a security update — iOS 12.5.8, build 16H88 — on 24 August 2026. That's not a rounding error. It's the most recent entry in a maintenance branch Apple has kept alive for a phone approaching its thirteenth birthday.

The iPhone 5s stopped getting new iOS versions when iOS 13 shipped in 2019, excluded from that release and every one since. Tracking major-version eligibility alone, you'd have written this phone off as unsupported in 2019. Instead, seven years later, Apple is still closing security holes on it. That gap — between "stopped getting new iOS" and "stopped getting patched" — is the entire subject of this page, and the 5s is its clearest example.

How a maintenance branch works, and how to recognize you're on one

The mechanism is simpler than it looks. When Apple ships a new major iOS version, some older devices are excluded — usually because the release needs hardware capabilities (a newer chip, more memory, a required security feature) those devices lack. Apple doesn't stop developing for the excluded devices immediately: it forks a maintenance branch at the version they were last running and continues backporting tested security fixes to it, in parallel with active development on the current major version.

That's exactly what the six-branch table shows. iOS 13 dropped the iPhone 5s, 6, and 6 Plus onto the iOS 12 branch, now at 12.5.8. iOS 16 dropped the 6s, 6s Plus, 7, 7 Plus, and first-gen SE onto the iOS 15 branch, now at 15.8.8. iOS 17 dropped the 8, 8 Plus, and X onto the iOS 16 branch, now at 16.7.16. iOS 26 dropped the XS, XS Max, and XR onto the iOS 18 branch, now at 18.7.10. Every row in the table is a snapshot of one of these cutoff events, still being actively patched.

You can recognize this on your own phone without reading Apple's release notes. If your iPhone stopped being offered a jump to the newest whole-number iOS version, but Settings still periodically offers a small update — the last digit climbing (18.7.9 to 18.7.10, say) rather than the version number itself changing — that small update is the maintenance-branch patch. It looks unremarkable on purpose: no new icon, no feature list, just a quietly closed vulnerability. Our build number explainer breaks down what a string like 22H374 actually encodes.

The one branch with no iPhones on it

One row stands out for a different reason: iOS 17.7.11 currently has zero iPhones on it. It's a real, actively maintained branch — posted 24 August 2026, same as the rest — but it exists purely for six iPad models, with no iPhone anywhere in its device list. That breaks the pattern every other row follows, and it's worth explaining.

Here's the honest read, working strictly from what the branch table itself shows. Trace the iPhone cutoffs and there's no gap at iOS 17: that release dropped the 8, 8 Plus, and X, and they needed a home on the branch below it — iOS 16.7.16, exactly where they sit. No iPhone's support window ends at the last version of iOS 17 itself, because no iPhone was dropped by iOS 18 — every phone that qualified for 17 also qualified for 18, and the next iPhone cutoff didn't come until iOS 26 dropped the XS family onto the iOS 18 branch. Going purely by the pattern, no iPhone generation ever needed the iOS 17 branch.

iPadOS has increasingly diverged from iOS in which hardware generations it drops and when, especially since it became its own numbered platform. It's reasonable to infer some iPad models had their support window end while iOS 17 was current, even though the matching iPhone lineup saw no cutoff that year. That's a plausible read built directly from the data, not something Apple states outright — it doesn't publish the reasoning behind why a branch exists for one platform and not another, so treat this as informed inference rather than a confirmed mechanism.

What a security-only branch doesn't give you

This is the section that matters most if you're deciding whether an older iPhone is fine to keep using, and the part most "how long do iPhones get updates" articles skip. Being patched and being current are not the same thing. A maintenance branch buys real protection against the specific vulnerabilities Apple has fixed on it — that's genuine. But it's deliberately narrow, with real consequences:

• No new features, ever. A maintenance branch is frozen at its major version's feature set permanently. The iPhone 5s on iOS 12.5.8 will never see anything from iOS 13 through 26 — Apple backports fixes serious enough to warrant it, not capabilities.
• No new Safari engine capabilities. The web moves independently of iOS's release cycle. A phone stuck on an old WebKit build increasingly can't render modern sites correctly, and that gap widens every year the branch stays frozen, even while it keeps getting patched.
• App compatibility erodes regardless of Apple's patching. Developers set a minimum supported iOS version for their own reasons — new APIs, dropped legacy support — and that minimum climbs independent of whether Apple is still patching your OS. A banking or retailer app can simply stop supporting your iOS version, security patches or not.
• No new anti-fraud or platform-level protections. Some meaningful security improvements aren't backported at all — they're new capabilities introduced with a major release, available only going forward.

Put together: a well-maintained old iPhone is safer than an unpatched one, full stop, but "still getting security patches" and "fully current" are different claims. If you're weighing the beta track instead, the same principle applies there — beta builds carry current security fixes, as covered in our beta safety guide — even though stability is a separate question.

If your iPhone is about to miss iOS 28

iOS 28 is a 2027 projection, not a confirmed lineup — the site's working stance is that iPhone 13 and newer should be expected to qualify, with iPhone 12 support genuinely uncertain. If your phone lands on the wrong side of that line, the pattern on this page is the most useful thing to carry into that decision: being dropped by iOS 28 would not mean your phone goes unpatched the next day. Going by how every cutoff in the table above has played out, a device dropped by iOS 28 would most likely land on a maintenance branch at its last major version and keep receiving security-only updates for a meaningful stretch afterward — quite possibly years, judging by how the iOS 18, 16, 15, and 12 branches have all held up.

Practically: don't panic-upgrade the day iOS 28 eligibility is announced, and don't treat a missed major version as a hard safety deadline. Watch the real signal — whether Settings keeps offering small point updates on your current major version — and treat app compatibility, not a rumored cutoff date, as your actual forcing function for replacing the device. For the two borderline cases, see iPhone 12 and iOS 28 and iPhone 13 and iOS 28; the full current lineup is on the iOS 27 supported devices page.

How we got this data

Everything in the branch table comes directly from Apple's own software-availability feed at gdmf.apple.com/v2/pmv — the same public endpoint Apple's software-update system queries to decide what to offer a given device. It lists every iOS branch Apple is currently serving, the exact build number, the date posted, and the device model identifiers eligible for it. We checked this feed on 2 September 2026 and mapped each identifier to its retail model name using only verified, publicly documented mappings; where a mapping wasn't independently confirmable, we described the range in prose instead of guessing. Nothing here is sourced from rumor sites or forum reports — it's a direct read of Apple's own infrastructure, which is also why it can change: Apple updates this feed with every new build, and a branch active today isn't guaranteed to stay active indefinitely.

The bottom line

There's no fixed number Apple has ever committed to — but the observable pattern, read straight from Apple's own feed, is generous: multiple years of security-only patching after a device stops getting new iOS versions, and in the most extreme case currently visible, close to thirteen years and counting for the iPhone 5s. That's real. The honest caveat is that patched isn't the same as current — a security-only branch closes known vulnerabilities without ever adding a feature, a new Safari capability, or a guarantee that your apps keep working. Deciding whether to keep an old iPhone running, or planning around iOS 28 eligibility, should rest on that distinction — not a mythical cutoff date.

Common questions