Apple Just Turned Off the Restore Button on a Decade of iPhones.

Somewhere in a garage or a junk drawer, there's an iPhone 5c set up as a kid's first phone: no SIM, no data plan, just enough functionality to text grandma and play a few games. As of this week, if that phone ever gets stuck in a boot loop or locked behind a forgotten passcode, there is no way to bring it back. Apple didn't disable the phone. It disabled the door.

On July 8, Apple stopped signing a batch of iOS builds going back to iOS 6, spanning eight cellular models: the iPhone 4, 4S, 5, and 5c, along with the iPad 2, third-generation iPad, fourth-generation iPad, and the original iPad mini. Every device already running its current software keeps working exactly as it did the day before. What disappeared is the fallback. If any of those builds ever needs to be reinstalled through Finder, iTunes, or a direct IPSW file, there is no longer a signed path to do it.

That distinction, between a phone breaking and a phone becoming unrestorable, is the entire story, and it's worth being precise about mechanics before getting to motive.

What actually got cut off

Apple didn't revoke the iOS versions themselves. What it revoked is signature validation for the baseband firmware tied to those builds: the low-level software that runs each device's cellular modem. That's why the list is exclusively cellular hardware. Wi-Fi-only iPads never carry a modem, so there was never a baseband signature to pull in the first place.

The one entry worth pausing on is iOS 8.4.1. Apple had kept that OTA build signed for years after it stopped mattering to almost anyone, because several devices on this list had to pass through 8.4.1 as a required stepping stone on the way to iOS 9, and that same signed build doubled as the only route back if the upgrade went sideways. That fallback is now gone for nearly every device from the 4S through the iPhone 5. If you were holding onto an old build specifically because it was your insurance policy against a bad update, the insurance just lapsed.

Why the modem, and why now

Apple has never published a rationale for individual signing cutoffs, and this one is no exception, but the pattern points somewhere specific. Baseband firmware isn't just software that makes calls work. It's the layer that negotiates directly with cell towers, and a decade-old, unpatched modem stack is a meaningfully different security posture than a decade-old app processor. Carriers have spent years retiring the 3G and CDMA networks these basebands were built to negotiate with in the first place, which strips away the argument that any of this firmware still needs to talk to a live network. Once the network side is gone, the calculus for Apple shifts from "keep this working for the handful of people still using it" to "why are we still validating cryptographic signatures for firmware with no legitimate network to reach."

There's also a quieter maintenance argument. Every signed build Apple keeps alive is a certificate chain, a set of servers, and an attack surface someone eventually has to think about. Basebands in particular have a history of being the softest target on a phone precisely because they run with elevated privileges and get the least security attention of any subsystem. Closing the restore path on modem firmware nobody can use on a live network anymore is a low-cost way to shrink that surface, even if the population of affected devices rounds to a rounding error against Apple's overall install base.

None of that requires malice. It also doesn't require Apple to have weighed the tradeoff the way an owner would.

The part that actually matters

The MacRumors comments under this story spent more time on principle than on the iPhone 5c. One reader's scenario cuts right to it: a repurposed legacy iPhone handed to a kid, no data plan attached, existing purely as a locked-down toy. If that device ever gets stuck behind a passcode nobody remembers, DFU restore was always the last resort. That resort is gone, not because the hardware failed, but because a server thousands of miles away stopped agreeing to vouch for the software.

That's the mechanism underneath every iOS device, not just the ones on this list. A restore has never been a purely local operation. It has always required Apple's signing infrastructure to say yes, which means Apple has always held a switch that determines how long any given software version can be reinstalled, on any device, at any point after release. Most of the time that switch is invisible, because most people update forward and never look back. It only becomes visible when someone needs to go backward and finds the door closed.

This lands the same season TBTL has been tracking a related thread: watchOS 27's compatibility list dropped five Apple Watch models in a single cycle, the steepest cutoff in the platform's history, driven by a chip requirement rather than a business decision about which customers to keep serving. Different mechanism, same underlying fact. Apple's platforms have always come with an expiration date that Apple sets unilaterally, sometimes through hardware requirements, sometimes through a signing server, and owners generally find out which one applies only after the fact.

The devices unsigned this week are genuinely obscure. Nobody is running a business on a CDMA iPhone 4 in 2026. But the mechanism that just closed a decade-old restore path is the identical mechanism sitting underneath the iPhone 17 in your pocket right now. It works exactly the same way on current hardware, it just hasn't been pointed at current hardware yet. That's not a conspiracy. It's just a fact worth sitting with the next time a software update on a device you actually rely on goes wrong at 11 p.m. and the only fix is a restore Apple has to agree to let happen.