• Apple's latest iOS update has been found to undermine NordVPN's anti-phishing tool
• The feature that causes the issue, Connectivity Assist, is turned on by default as part of the update
• According to NordVPN, the issues could have been prevented

Apple's new iOS 27 operating system update is undermining NordVPN’s anti-phishing tool, leaving users exposed to privacy vulnerabilities, the VPN has warned.

Connectivity Assist, a Wi-Fi Assist feature included in Apple’s twentieth operating system release, conflicts with NordVPN’s real-time protection, preventing it from working properly, the provider has found.

What’s worse? The tool is enabled by default, meaning users may not even know. What's more, other privacy tools on your phone may also have been compromised.

The problem with Connectivity Assist

Connectivity Assist optimises your Wi-Fi connection by supplementing slow or unreliable Wi-Fi connections with mobile data, detecting connection issues, and redirecting requests to your mobile operator’s DNS servers instead.

However, when NordVPN’s anti-fraud protection blocks a phishing site, Apple may also interpret the failed connection as a Wi-Fi issue and switch to mobile data—outside the VPN’s protection—thereby compromising the functionality of the NordVPN tool.

The only option currently available to ensure full protection is to disable Connectivity Assistant, so it can’t switch to mobile data when real-time protection blocks a website.

Alternatively, you can choose only to enable real-time protection when using a VPN by disabling NordVPN’s ‘always on’ option - but this still leaves them unprotected when using mobile data - just now by choice.

“People are being made to choose between two things they shouldn't have to choose between, and there's no good way for us to fix it,” Laura Tyrylyte, Head of Public Relations at NordVPN, tells TechRadar.

Can this be prevented?

Could Apple have helped resolve these issues before the release? Perhaps, according to the VPN representative. “Apple knew the feature interferes with DNS-based filtering before it shipped,” Tyrylyte notes. “Their own support page tells people running an ad blocker to switch Connectivity Assist for that network. Somebody spotted the conflict, it just didn’t get fixed.”

Users of Pi-hole, Firewalla, and other DNS-based filtering tools had previously reported the same behaviour, and Cloudflare's WARP also stopped blocking malicious sites following the update, NordVPN stressed.

Apple engineers have suggested alternative solutions in the forums, but these only work if users configure the DNS settings themselves, notes Tyrylyte.

“Deciding to treat deliberate filtering as a failed connection is a choice somebody made. They could have written it the other way: if a user-installed DNS service decides to resolve or block the query, leave that judgement alone,” Tyrylyte adds.

“Instead, the problem got handed to users, who now need to end up fielding the support tickets for something we can’t change,” she stresses.

NordVPN states that this is not the first time a change made by Apple to the network has compromised a security feature on iOS, with the VPN having to inform users.

In 2023, Apple’s VPN API contained vulnerabilities that disrupted NordVPN operations. “Both times users ended up having to pick between an Apple feature and their own protection, and both times Apple was the only one who could have prevented that,” Tyrylyte says.

“Apple makes the call, and we find out what the call was when the release lands, she stressed.

Whoever’s responsibility this is, one thing is for certain: it is users who stand to pay the highest price when tools quietly stop working. And reporting the issue in the press as a solution seems a poor substitute for preventing the problem in the first place.

Apple is yet to respond to a request for comment.