Apple released iOS 27.2.1, fixing nine security bugs. Two iMessage flaws could have exposed private group chat messages.
Apple has released iOS 27.2.1, a security update for iPhones that fixes nine bugs, including two iMessage flaws that could have exposed group chat messages.
The more serious of the two, tracked as CVE-2026-113961, could have let a remote attacker join a group chat without an invitation and receive its messages, according to Apple’s security notes. Apple said it fixed the authorization issue through improved validation. A related flaw, CVE-2026-113960, could have let someone newly added to a group read messages sent before they joined. Adam Boynton, a senior enterprise strategy manager at the device-management firm Jamf, said the attack requires no physical access, which is why it matters.
The update also repairs several Bluetooth and AirPlay problems. Two could have let a malicious device or an attacker within Bluetooth range pair with an iPhone without the owner’s approval, and another is a memory corruption issue that requires the attacker to be within Bluetooth range. Two more could have let an attacker bypass the limit on pairing code attempts. Apple’s notes do not say what a paired device could then do.
Apple has not said any of the flaws were exploited, and the notes do not say whether every member of a group chat must update to be protected. The updates also fix a flaw in Google’s Brotli compression library, which the U.S. Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities catalog on Oct. 27.
Apple also released iOS 26.7.3 for users who have not moved to iOS 27, and iOS 18.7.12 for older iPhones. The Hacker News reported that the iOS 18.7.12 notes do not list the iMessage or Brotli fixes, and that updates for the iPhone XS, XS Max and XR do not list them either. Users can install the update manually by opening Settings, then General, then Software Update.
This report draws on coverage by Forbes and The Hacker News.