In response to the DarkSword vulnerabilities, Apple released backported security fixes for several iOS versions. They also started sending push notifications to get users to update:

"Critical Security Update Needed: Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone. Install this critical update to protect your iPhone."

How does this notification work? Did they foresee the need to send security alerts and build that capability into iOS years ago? After days of capturing my iPhone 7 network traffic while waiting to get the alert, I finally got it.

Turns out they send a push notification targeted at itunesstored, with identifier com.apple.AMSFollowUpIdentifier.Billing. AMS means Apple Media Services. That sounds like it's the kind of alert they send for "your card was declined when charging your monthly Apple Music subscription".

This notification mechanism is flexible enough that they can set the text to "Critical Security Update Needed" and the link target to prefs:root=General&path=SOFTWARE_UPDATE_LINK so it takes you to the Software Updates screen. That's a clever hack... but man, it's a hack.

Apple released iOS 18.7.7 for all iPhones, fixing serious security issues. If you're sticking to 18.x to avoid Liquid Glass you should install this update. This is not April Fools.

(If you care about jailbreaking, then as usual don't update, but maybe turn on Lockdown Mode...)

Dad bought a FIDO2 key. He goes to bank website, clicks "add security key", website says "to verify your identity you need an authorization code, call [phone number] to get it".

Calling that number gets you a voice bot that doesn't even remotely understand what you need and offers you unrelated options.

– I want to add a security key.
– you want to see if your check has cleared, please answer yes or no.
– no.
– [old IVR-style menu with unrelated options]

Since the bank's AI support is making his life harder, my dad is approaching the problem by throwing more AI at it and asking chatbots for help. It's not going well either.