A newly disclosed hardware-level security flaw affects several older iPhone, iPad, and Apple Watch models that are still widely used. The concern is significant because the weakness sits inside SecureROM, a permanent boot code layer built directly into the chip and impossible to patch through software updates.
For users who keep sensitive files, work data, or private accounts on older Apple devices, the finding raises a different kind of security question. It is not a routine bug fix issue, but a flaw rooted in the earliest stage of the device boot process.
Why this flaw stands out
Security firm Paradigm Shift published a detailed report along with a proof-of-concept exploit called usbliter8. The exploit targets SecureROM on devices using the A12, A13, S4, and S5 chips.
Because SecureROM is permanently embedded at the chip level, Apple cannot close this weakness with an iOS, iPadOS, or watchOS update. Paradigm Shift said it worked with Apple before making the finding public, but the underlying issue remains tied to hardware that cannot be rewritten.
Which devices are affected
The affected iPhone lineup includes the iPhone XR, iPhone XS, iPhone XS Max, iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, and the second-generation iPhone SE.
On the tablet side, the list covers the third-generation iPad Air, fifth-generation iPad mini, as well as the eighth- and ninth-generation iPad. The wearable devices affected are the Apple Watch Series 4, Apple Watch Series 5, and first-generation Apple Watch SE.
The list also includes the second-generation Apple TV 4K and Studio Display. However, the main concern remains centered on iPhone and iPad owners, since those devices are used far more often for daily communication, work, and personal data storage.
What is not affected
Two important details limit the broader security impact. First, the exploit does not reach the Secure Enclave, so passcodes and encryption keys are said to remain protected.
Second, the attack is not the kind of threat a casual thief can easily deploy in passing. It requires direct access to the device and technical skill that is far beyond a simple opportunistic grab.
Devices with the older A11 chip, such as the iPhone 8 and iPhone X, are not included in this specific issue. Newer chips starting from A14 are also said to be safe from the usbliter8 method.
What users should take from this
For most everyday users, the real-world risk is still considered relatively low. A strong passcode and basic physical control over the device remain important barriers against misuse.
That said, the context matters more for people who rely on older devices for sensitive work, important account access, or private storage. In those cases, a flaw that cannot be patched through software becomes a stronger reason to rethink long-term use.
Paradigm Shift recommends considering an upgrade to a newer device if security is the top priority. That advice carries extra weight because the issue is not a temporary software bug waiting for a fix, but a weakness built into the foundation of the boot process itself.
Why the finding matters beyond everyday users
The disclosure also draws attention from the jailbreak community, where bootrom-level exploits are especially valuable. A flaw at this depth can affect the device for as long as it remains in use, which makes it more persistent than ordinary software vulnerabilities.
For Apple, the discovery reinforces the need to harden future chip designs. Since devices with A14 and later are said to be unaffected by this method, attention now shifts to how owners of older hardware weigh security against the cost of upgrading.
For now, the message is straightforward. Devices on the affected list are not facing a mass threat that is easy to exploit, but they also cannot rely on software updates to close the gap.
