By the Smili Phone team
This week brought two reminders that the most important phone update is the boring one: the security settings. Apple rushed out an emergency patch for iPhones and iPads, and Google expanded a little-known Android security mode that locks down your phone with a single switch. Here is what each one does, and what to turn on.
Apple's emergency patch: install it today
Apple issued iOS 26.7.1 and iPadOS 26.7.1 after confirming a flaw in CoreGraphics, tracked as CVE-2026-86950, may already have been exploited in what Apple called an "extremely sophisticated attack" against specific targeted individuals. The vulnerability was discovered and reported by Meta's product security team.
It affects iPhone 11 and later, plus the recent iPad Pro, iPad Air, iPad, and iPad mini models listed by Apple. Already running iOS 27? This exploit does not affect you. Everyone else: open Settings, tap General, then Software Update, and install the patch now. It takes a few minutes.
Android's Advanced Protection gets bigger
Google introduced Advanced Protection with Android 16: one switch that turns on a collection of Android and Google app security features. With Android 17, that collection is getting longer.
Intrusion Logging is the standout. If you ever suspect your phone was compromised, this opt-in feature records security and network activity, encrypts the logs end to end, and stores them in the cloud on a rolling 12-month basis. Google says the records are tamper-resistant and only you can access them, so evidence survives even if an attacker wipes traces from the phone. The feature was built with input from Amnesty International and Reporters Without Borders.
Then there is USB Protection: plug a new USB accessory into a locked Pixel on Android 16 or later and it can only charge; data stays blocked until you unlock the phone. That closes a physical route attackers use with rogue chargers and compromised ports. Also new: accessibility permissions limited to verified apps, Chrome's WebGPU switched off, and a lock after repeated failed authentication attempts.
iOS 27's scam detector
iOS 27 adds Impersonation Risk Detection for social engineering scams. When a supported app detects a high-risk action, like changing an important password, it asks the system for a risk assessment and gets back a level: unknown, medium, or high. The app can then delay a payment or ask you to verify your identity. All of the analysis happens on your phone.
Your three-minute security check
- Update your phone today. On iPhone: Settings, then General, then Software Update. On Android: Settings, then System, then Software update. Running old software is the single biggest risk to phones.
- On Android, turn on Advanced Protection and leave it on. It was built for journalists and public figures, but anyone can use it, and the new additions make it more useful than ever.
- Watch for scam pressure, not just scam messages. The scam that steals your accounts rarely looks technical: it looks urgent. A payment delay or an extra identity check is the system doing its job.
Security features only work if you switch them on. Take three minutes today. If your phone is acting strangely or an update will not install, bring it by our Escondido shop. We will take a look and give you an honest answer. Diagnosis is free, as always.
Related: repair or replace: how to decide · back up your phone before a repair
