Apple Ships iOS 27.2.1 With Patches for Nine Flaws, Including iMessage Eavesdropping Risk

Apple released iOS 27.2.1 and iPadOS 27.2.1 on Monday, a maintenance update that closes nine security holes, two of which could have let outsiders read private iMessage conversations. The company also pushed security-focused updates for devices that cannot run the current operating system, extending coverage to handsets as old as the iPhone XS.

The download weighs in at roughly 1.48GB over the air on an iPhone 18 Pro. Apple's release notes describe the build only as containing bug fixes and security updates, with the technical detail posted separately in its security advisories.

According to the advisories, the two Messages flaws are the most consequential. One, tracked as CVE-2026-113961, is an authentication problem that could allow a remote attacker to join an iMessage group chat without an invitation and receive the messages sent to it. The other, CVE-2026-113960, could let a user newly added to a group read messages that were posted before that person joined.

Bluetooth received equally heavy attention. A malicious Bluetooth device could establish a pairing without any action from the owner (CVE-2026-113965), and an attacker within radio range could sidestep the limit on pairing-code attempts and pair with the handset unprompted (CVE-2026-113964). A separate Bluetooth issue, CVE-2026-113970, could allow an attacker in range to corrupt process memory.

AirPlay and the rapportd daemon both carried flaws that let an attacker in Bluetooth or local-network range get around the cap on pairing-code attempts (CVE-2026-113968 and CVE-2026-113969). App Intents, the framework apps use to expose actions to Siri and shortcuts, had a flaw that could give an app access to sensitive user data (CVE-2026-113963). A memory-corruption bug in the brotli compression library (CVE-2026-111497) rounds out the list.

Apple said it is not aware of any of these issues having been exploited in the wild. The company does not attribute the discoveries in the summaries reviewed.

Note: Vulnerability counts are based on CVE identifiers listed in Apple's security advisories.

The same batch of fixes went out across the rest of the company's hardware. Mac received macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3; the Apple Watch got watchOS 27.2.1 and watchOS 26.6.1; and Vision Pro received visionOS 27.2.1. Many of the patches are identical from one platform to the because Apple's operating systems large blocks of code.

Apple left tvOS and HomePod software out of the release, though those builds could follow later in the week.

The breadth of the release reflects a pattern Apple has followed for years: when a feature-heavy update ships, a smaller follow-up arrives within weeks to clean up bugs and close holes found afterward. Version 27.2 landed in late October with a long list of new capabilities, and Monday's build is the cleanup pass. The company is already testing iOS 27.3, which is expected month with a redesigned Health app, a karaoke-style Apple Music feature and expanded StandBy controls.

For Apple, the security cadence matters commercially as much as technically. The company has spent years positioning the iPhone on privacy and device security, and a flaw that lets an uninvited party sit in a group chat cuts against that pitch. Extending patches to the iPhone XS, a model now several generations old, also keeps a large installed base of older hardware from becoming a soft target.

Users can install the update through Settings, then General, then Software Update. Devices with automatic updates enabled will apply it without prompting.

The practical exposure from the Bluetooth and AirPlay flaws is limited to nearby attackers, but the iMessage issues require no physical proximity, which raises the value of installing the patch quickly. Group chats that include people outside a user's contacts are the most exposed scenario.