When Apple shipped iOS 27.2.1 on Monday, the release notes said little beyond “bug fixes and security updates.” We covered the Mac side of that round, the eMudhra certificate fix for Terminal tools. Now that Apple’s security notes have been picked apart, the iPhone side turns out to matter just as much.
The updates patch 10 vulnerabilities across iOS, iPadOS, macOS, watchOS, and visionOS, and SecurityWeek counts half of them as Bluetooth and AirPlay pairing problems. Two more involve iMessage group chats.
The pairing bugs
Pairing codes are what stop a stranger’s device from connecting to yours. Several of the fixed bugs undercut that protection. According to Apple’s iOS 27.2.1 security notes:
- AirPlay (CVE-2026-113968): “An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.” In other words, someone nearby could keep guessing codes instead of being cut off.
- rapportd (CVE-2026-113969): the same kind of bypass for AirPlay pairing codes, but from an attacker on the same network.
- CoreUtils (CVE-2026-113964): a rate-limit bypass that Apple says could let an attacker in Bluetooth range “pair with a device without user interaction.”
- CoreUtils (CVE-2026-113965): “A malicious Bluetooth device may be able to establish a pairing without user interaction.”
- Bluetooth (CVE-2026-113970): a use-after-free bug that could let an attacker in Bluetooth range corrupt process memory.
All five are fixed in every release Apple shipped this round, from iOS 27.2.1 down to iOS 18.7.12 and macOS Sequoia 15.8.3, SecurityWeek notes. The common thread is that the attacker has to be physically close or on your network. That’s a real limit, but think of coffee shops, airports, offices, and shared Wi-Fi.
The iMessage bugs
The two Messages flaws are the ones most people will understand right away:
- CVE-2026-113961: “A remote attacker may be able to join an iMessage group chat and receive its messages.” No proximity required.
- CVE-2026-113960: “A user added to an iMessage group may be able to access messages sent before they joined.” Apple fixed this one by removing the vulnerable code.
Both were reported by an anonymous researcher. 9to5Mac summed up the first as an attacker potentially joining a group chat uninvited.
Is anyone exploiting these?
Apple doesn’t say any of these bugs were used in attacks. The one flaw with known real-world exploitation is a bug in the Brotli compression library, CVE-2026-111497, which the update also fixes. SecurityWeek says attackers have targeted it in the wild, but there’s no indication of attacks against Apple products.
What to install
- iPhone 11 and later: iOS 27.2.1. Apple also lists iPad Pro 12.9-inch (4th generation) and later, iPad Pro 11-inch (2nd generation) and later, iPad Air (4th generation) and later, iPad (9th generation) and later, and iPad mini (6th generation) and later for iPadOS 27.2.1.
- Staying on an older major version: iOS 26.7.3 or iOS 18.7.12. The 18.7.12 update covers iPhone XS, XS Max, XR, and the 7th-generation iPad, and it fixes one extra bug: someone with physical access could pair the device with an AirPlay receiver from the Lock Screen.
- Apple Watch: watchOS 27.2.1 or 26.6.1.
- Vision Pro: visionOS 27.2.1.
- Mac: macOS Golden Gate 27.2.1, Tahoe 26.7.3, or Sequoia 15.8.3.
On iPhone, go to Settings, then General, then Software Update.
Our take
Point releases with vague notes are easy to ignore for a week or two. This one shouldn’t be. Bugs that let a nearby device skip the pairing check, or let an outsider read a group chat, are the kind of quiet holes nobody notices until it’s too late. None of them are known to be exploited, which is exactly the right time to patch.
Sources: Apple Support (Nov. 9), SecurityWeek (Nov. 11), 9to5Mac (Nov. 9), and NVD.
Reporting reference: Apple Support ↗