Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, a security-focused update with nine fixes. The most important involves iMessage: according to Apple's security notes, a remote attacker could join an iMessage group chat and receive its messages without being invited.
The flaw, tracked as CVE-2026-113961, was described by Apple as an authorization issue, fixed with improved validation, and credited to an anonymous researcher. A second Messages flaw, CVE-2026-113960, could let someone newly added to a group read messages sent before they joined, something that should not happen in normal iMessage behavior. Apple says it fixed that case by removing the vulnerable code.
The remaining fixes concern wireless pairing: a malicious Bluetooth device could pair without user interaction (CVE-2026-113965), and nearby attackers could bypass the rate limit on Bluetooth and AirPlay pairing code attempts (CVE-2026-113964, CVE-2026-113968 and CVE-2026-113969). There is also a Bluetooth use-after-free flaw (CVE-2026-113970), an App Intents flaw that could expose sensitive user data (CVE-2026-113963, found by László Várady), and a flaw in Google's Brotli compression library (CVE-2026-111497), which has been on the US CISA catalog of exploited vulnerabilities since October 27.
Apple has not said the iMessage flaws were exploited. With the details now public, however, devices without iOS 27.2.1 are more exposed. The recommendation is to install the update as soon as possible under Settings > General > Software Update.
iOS 27.2.1 covers iPhone 11 and later and recent iPads, including iPad Pro 12.9-inch (4th generation) and 11-inch (2nd generation) and later, iPad Air (4th generation) and later, iPad (9th generation) and later, and iPad mini (6th generation) and later. On the same day, Apple also released iOS 26.7.3, with the same iMessage fixes, and iOS 18.7.12 for older devices, plus matching updates for macOS, watchOS and visionOS.
One flaw was left out, researcher says
Not everything was fixed in this round. The researcher known as forcequitOS said on X on November 10 that the sandbox flaw nicknamed worse_query, which can let malicious apps access data from other apps, including crypto wallets, was not fixed in iOS 27.2.1 or in the first iOS 27.3 beta. That is the researcher's claim, not Apple's: the official security notes do not mention worse_query. Binance has warned crypto users about the risk. It is therefore a statement to follow, not a fact confirmed by Apple.
Image credit: photograph of an iPhone, via Wikimedia Commons.
Read also
- Apple vai verificar links públicos do iCloud por conteúdo nocivo a partir do iOS 27.3
- Patch Tuesday de novembro corrige 1.093 falhas e um zero-day do Outlook já explorado
- Google corrige zero-day do Chrome já explorado em ataques
Sources
- Apple — About the security content of iOS 27.2.1 and iPadOS 27.2.1
- MacRumors — Here's What Apple Fixed in iOS 27.2.1 and macOS 27.2.1
- tbreak — Apple iOS 27.2.1 update fixes iMessage group chat flaw
- crypto.news — Apple's iOS 27.2.1 update leaves crypto wallet security flaw unpatched
Transparency disclaimer: this article was produced with the help of artificial intelligence, based on cross-checking public posts on X and sources on the internet. We recommend consulting the original sources to confirm the information.
By Muse
