Apple clarifies security update policy: Only the latest OSes are fully patched

Earlier this week, Apple launched a document clarifying its terminology and policies round software program upgrades and updates. A lot of the data within the doc is not new, however the firm did present one clarification about its replace coverage that it hadn’t made express earlier than: Regardless of offering safety updates for a number of variations of macOS and iOS at any given time, Apple says that solely units operating the newest main working system variations ought to count on to be totally protected.

All through the doc, Apple makes use of “improve” to seek advice from main OS releases that may add huge new options and person interface adjustments and “replace” to seek advice from smaller however extra regularly launched patches that largely repair bugs and handle safety issues (although these can sometimes allow minor function additions or enhancements as effectively). So updating from iOS 15 to iOS 16 or macOS 12 to macOS 13 is an improve. Updating from iOS 16.0 to 16.1 or macOS 12.5 to 12.6 or 12.6.1 is an replace.

“Due to dependency on structure and system adjustments to any present model of macOS (for instance, macOS 13),” the doc reads, “not all recognized safety points are addressed in earlier variations (for instance, macOS 12).”

In different phrases, whereas Apple will present security-related updates for older variations of its working techniques, solely the newest upgrades will obtain updates for each safety drawback Apple is aware of about. Apple at present offers safety updates to macOS 11 Huge Sur and macOS 12 Monterey alongside the newly launched macOS Ventura, and previously, it has launched safety updates for older iOS variations for units that may’t set up the most recent upgrades.

This confirms one thing that independent security researchers have been aware of for a while however that Apple hasn’t publicly articulated earlier than. Intego Chief Safety Analyst Joshua Lengthy has tracked the CVEs patched by totally different macOS and iOS updates for years and has typically discovered that bugs patched within the latest OS variations can go months earlier than being patched in older (however nonetheless ostensibly “supported”) variations, after they’re patched in any respect.

That is related for Mac customers as a result of Apple drops help for older Mac and iDevice fashions in most upgrades, one thing that has accelerated somewhat for older Intel Macs in recent times (most Macs nonetheless obtain six or seven years of upgrades, plus one other two years of updates). Which means yearly, there is a new batch of units which are nonetheless getting some safety updates however not all of them. Software program like the OpenCore Legacy Patcher can be utilized to get the latest OS variations operating on older {hardware}, but it surely’s not at all times a easy course of, and it has its personal limitations and caveats.

That mentioned, this in all probability should not dramatically change your calculus for when to upgrade or stop using an older Mac. Most individuals operating an up-to-date Huge Sur or Monterey set up with an up-to-date Safari browser ought to be protected from most high-priority threats, particularly when you additionally preserve the opposite apps in your Mac up to date. And Apple’s documentation would not change something about the way it updates older software program; it merely confirms one thing that had already been noticed.

We have requested Apple to be extra up-front about its safety communication, and this can be a step ahead in that regard. However when you consider you are being particularly focused by attackers, you’ve gotten another excuse to ensure your software program (and {hardware}) are totally up to date and upgraded.