Out-of-cycle security updates for nearly all Apple devices

Without a beta period, Apple made updates for nearly all of its major operating systems available for download overnight Monday. The company is patching security vulnerabilities that also affected older software versions. These include attacks via Bluetooth and AirPlay, as well as the ability to “hack into” iMessage groups. Install the updates as soon as possible.

iOS 27.2.1 and iPadOS 27.2.1 patch a total of nine vulnerabilities. Devices could be attacked via AirPlay and Bluetooth. AirPlay flaws made it possible to bypass rate limits, allowing nearby attackers to crack pairing codes — and gain access to other devices' audio and video signals. Another flaw in Rapportd also involved bypassing rate limits for AirPlay pairing codes. Bluetooth could also be used to corrupt memory; it’s not yet clear whether this could also be used to carry out hacks.

Two flaws in CoreUtils also involved Bluetooth. They allowed devices to be paired without any action by the actual user and also made it possible to bypass rate limits on Bluetooth codes. In iMessage, attackers could remotely join chat groups and receive their messages — and send messages before becoming part of the group. Apple also patched a widespread bug in the Brotli compression format that is already being exploited . App Intents, in turn, made it possible to access sensitive data.

macOS 27.2.1 fixes eight of the nine vulnerabilities addressed in the iOS and iPadOS updates. App intents don't appear to be affected. Apple also updated watchOS ( to 27.2.1 ), which had all the vulnerabilities found in iOS and iPadOS, and visionOS (now 27.2.1 ), which was also fully impacted. Older versions are getting patches, too: iOS and iPadOS 26.7.3 (eight of nine vulnerabilities fixed; App Intents not included), iOS and iPadOS 18.7.12 (six bugs fixed, plus an AirPlay flaw in MediaRemote; iMessage patches not included), as well as macOS Tahoe 26.7.3 (all vulnerabilities except App Intents) and macOS Sequoia 15.8.3 (same).

Aside from the aforementioned Brotli attacks, which apparently aren’t currently targeting Apple devices directly, there are no reports of available exploits for the other vulnerabilities. But they could emerge quickly. It’s also unclear why Apple didn’t update tvOS. It, too, has AirPlay and Bluetooth stacks.

Empfohlener redaktioneller Inhalt

Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.

Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.