Is it safe to continue using a phone that no longer has update support?

You can expect your phone to receive at least one major operating system update or upgrade, such as when you upgrade from iOS 18 to iOS 26 or from Android 15 to Android 16, which often comes with new features and UI overhauls. Before the next operating system upgrade, the phone will receive smaller updates, called patches, which can fix bugs, improve performance and strengthen security. It’s this last point that’s important, because it makes the phone less vulnerable to malicious pieces of code called exploits. They are created to take advantage of system software vulnerabilities. Once your phone has been hacked by cybercriminals using an exploit, they can cause a lot of damage, including installing malware and stealing your personal information.

Exploits can and do exist even for phones that still have update support (no software is perfect). But they usually become useless quickly after the manufacturer releases a patch to remedy the situation. But once the updates stop, you no longer have this guarantee, which is why it is not safe to use this phone.

It doesn’t immediately become dangerous, but the risk increases with each passing day until it happens. Android users are in luck, however, because even once their phones become too old to use, they can still install a custom ROM to continue using them safely. It just needs to be a system that receives frequent updates.

There have been several cases of hackers exploiting old mobile operating systems. For example, Apple issued a warning in April 2024, urging users to update to the latest version of iOS to protect against active exploit kits known as Coruna and DarkSword that targeted outdated devices, from iOS 13 to iOS 16.

A hacker could steal people’s data if they click on a malicious link or visit a website compromised because of these exploits. Only iOS 15 and 16 received updates, even though Apple had stopped supporting them by then. And he urged iOS 13 and 14 users to upgrade to these versions. If there were iPhones that couldn’t upgrade from iOS 13 and 14 (fortunately, there weren’t), they would have been in perpetual danger.

A major example from the Android side is an exploit called Stagefright in 2015. It allowed hackers to hack Android phones running Android 2.2 (Froyo) to Android 5.1.1 (Lollipop) via MMS messages by exploiting a major weakness in the operating system’s media playback engine, allowing hackers to spy on users using their own phone’s camera and microphone. Even today, many Android phones that max out these versions are still vulnerable.

For iPhone users, when Apple stops releasing security patches, it’s time to upgrade because there is no custom ROM (modified versions of iOS) for it. Android has them because its source code is publicly available and can be downloaded and modified through the Android Open Source Project (AOSP). It is managed by Google, which adds security patches to it every month. This is what the manufacturers and creators of these custom ROMs use to keep your phone’s operating system safe.

There are several custom ROMs for Android users to choose from, but LineageOS is a good option. It is an open source Android distribution that can be installed on several devices from manufacturers like Samsung, Google and Motorola. It offers a simplified and ultra-light experience with its own set of open source applications, while bringing the latest Android security improvements.

GrapheneOS is another popular ROM but, so far, it only supports Google Pixels. Its main selling point is that it’s a privacy and security-focused operating system, with no pre-installed Google apps or services (no Gmail, Chrome, Google Maps, and no Gemini). It is possible to install Google’s apps and services, but they will run in an isolated (sandbox) environment, where they will not have access to your data or location for Google to track.