Apple's iPhone update from Monday, Nov. 9, closes a hole that could let a stranger slip into an iMessage group chat. According to Apple's security notes for iOS 27.2.1, a remote attacker "may be able to join an iMessage group chat and receive its messages." The same update fixes two Bluetooth flaws that could let a nearby device pair with an iPhone without the owner doing anything.
Matching updates went out the same day for iPads, Macs, Apple Watch and Vision Pro. Older iPhones got their own. Apple's notes do not say that any of the flaws has been used in attacks.
Two of the nine fixes in iOS 27.2.1 are in Messages. Besides the outsider who could join a group, a person added to a group could read messages sent before they joined. Apple says it fixed the second problem by removing the vulnerable code.
The Bluetooth problems need an attacker within range, such as someone in the same coffee shop or train car. A malicious Bluetooth device could pair "without user interaction," and a separate bug let an attacker get around the limit on how many pairing codes can be tried, then pair. Apple also fixed a Bluetooth memory corruption bug, plus similar pairing-code limits in AirPlay that someone in Bluetooth range or on the same network could get past. The list ends with an App Intents flaw that could let an app reach sensitive user data and a memory bug in brotli, a compression library.
Which devices get the fixes
| Update | Devices | Messages fixes included |
|---|---|---|
| iOS 27.2.1, iPadOS 27.2.1 | iPhone 11 and later, newer iPads | Yes |
| iOS 26.7.3, iPadOS 26.7.3 | iPhone 11 and later on iOS 26, iPads back to iPad 8th generation | Yes |
| iOS 18.7.12, iPadOS 18.7.12 | iPhone XS, XS Max, XR, iPad 7th generation | No |
| macOS Golden Gate 27.2.1, Tahoe 26.7.3, Sequoia 15.8.3 | Macs on those versions | Yes |
| watchOS 27.2.1 | Apple Watch Series 9 and later | Yes |
| watchOS 26.6.1 | Series 6 to 8, SE (2nd generation), Ultra | No |
| visionOS 27.2.1 | Apple Vision Pro | Yes |
Owners of an iPhone XS or XR get the Bluetooth and AirPlay fixes in iOS 18.7.12, plus one fix that does not appear in the iOS 27.2.1 notes. Someone holding the locked phone could have paired it with an AirPlay receiver from the lock screen. Those notes leave out the Messages flaws. Apple does not say whether the older software had them.
How to update
Apple's update steps start with a backup. Then plug the iPhone in, connect to Wi-Fi, open Settings, tap General, then Software Update, and tap Download and Install. Apple warns that a VPN or proxy can keep the phone from reaching its update servers.
On a Mac, the update sits in System Settings, under General and then Software Update, according to Apple's Mac instructions.
