27 September
What happened on this date in privacy, anonymity networks and censorship. Every year on the same date we add a new look back and keep the earlier ones as they were.
2026
An iPhone startup flaw that updates cannot fix
If you still use an iPhone X or an older model, your phone has a startup flaw that no software update can fix. On 27 September 2019, a researcher released checkm8, an exploit that targets the first code an iPhone runs at startup, which sits in read-only memory on the chip. Ars Technica's interview with the researcher reported that it works on 11 generations of iPhones, from the 4S to the X, and needs physical access to the phone. In the same interview, the researcher said that on models with a Secure Enclave, anyone without the passcode cannot read the data even with this exploit. If you still use one of these models, make sure it has a passcode, and on an iPhone 8 or iPhone X, which were still getting security updates as of May 2026, install the latest one.
Also on this day
- Belgium's Privacy Commission found that SWIFT, the interbank financial messaging network, broke Belgian data protection law by handing financial message data to the US Treasury under subpoenas. Source: Belgian Data Protection Authority
- Hamburg's data protection authority ordered Facebook to stop collecting data on WhatsApp users in Germany and to delete what it had already gathered. Source: TechCrunch
- After clashes between Azerbaijan and Armenia over Nagorno-Karabakh, social media and communications platforms were restricted across Azerbaijan. Source: NetBlocks