Apple has released iOS 27.2.1, a security-focused update that fixes nine flaws — including one that could let a stranger join your iMessage group chats and read the messages sent there. The update arrived on Monday, November 9, alongside iPadOS 27.2.1 and macOS 27.2.1, and it is available now for iPhone 11 and later.
Apple’s release notes say only that the update “provides bug fixes and security updates,” but the company’s security advisories, published the same day, spell out what is actually fixed. The most serious flaw is in Messages itself.
Key Takeaways
- Released: November 9, 2026 — iOS 27.2.1 and iPadOS 27.2.1, with macOS 27.2.1 the same day.
- What it fixes: nine security flaws across seven system components.
- Worst flaw: an iMessage bug (CVE-2026-113961) that could let a remote attacker join a group chat uninvited and read its messages.
- Also fixed: four Bluetooth and AirPlay pairing bugs that could bypass pairing-code limits or pair without any prompt.
- Devices: iPhone 11 and later; older devices get iOS 26.7.3 or iOS 18.7.12.
- Size: roughly 1.48GB over the air on an iPhone 18 Pro.
- Exploited in the wild? Apple says it is not aware of any of these flaws being exploited.
The iMessage Flaw You Should Care About
The headline fix is CVE-2026-113961. It is an authentication problem in Messages that could allow a remote attacker to join an iMessage group chat without an invitation — and then receive the messages sent to that group. Apple fixed it with improved validation.
A second Messages flaw, CVE-2026-113960, worked the other way round: someone newly added to a group chat could read messages that were posted before they joined. Apple fixed that one by removing the vulnerable code entirely.
If you use iMessage group chats — for family, work, or friends — these two fixes apply to you directly, and they are the reason this update is worth installing now rather than later.
Four Pairing Bugs Closed Too
Four of the nine fixes stop attackers from getting around the limits on pairing-code attempts — the codes that are supposed to protect your iPhone when another device tries to connect.
- AirPlay (CVE-2026-113968): an attacker in Bluetooth range could bypass the rate limit on pairing-code attempts.
- rapportd (CVE-2026-113969): someone on the same network could do the same for AirPlay pairing codes.
- CoreUtils (CVE-2026-113964): an attacker in Bluetooth range could bypass the limit and pair without any user interaction.
- CoreUtils (CVE-2026-113965): a malicious Bluetooth device could pair with your iPhone without any interaction from you.
The remaining fixes cover an App Intents flaw that could let an app reach sensitive user data (CVE-2026-113963), a Bluetooth use-after-free bug that could corrupt process memory (CVE-2026-113970), and a flaw in the brotli compression library where maliciously crafted input could cause memory corruption (CVE-2026-111497).
Older iPhones Are Covered Too
Apple also pushed security updates for devices that cannot run iOS 27. iOS 26.7.3 and iPadOS 26.7.3 cover devices on the version 26 line, while iOS 18.7.12 and iPadOS 18.7.12 extend coverage to handsets as old as the iPhone XS, iPhone XS Max and iPhone XR, plus the seventh-generation iPad. That is a separate update from last week’s iOS 18.7.11 zero-day fix for the same older models.
No New Features — iOS 27.3 Comes in December
Do not expect anything new from iOS 27.2.1. It is a cleanup pass after iOS 27.2, which landed in late October with a long list of new features and 163 security fixes of its own. The next feature update, iOS 27.3, is already in public beta and is expected in December, with a redesigned Health app, Live Rewind and Siri Recap among the features being tested.
How to Install iOS 27.2.1
Open Settings, tap General, then tap Software Update. The download is about 1.48GB on an iPhone 18 Pro, so use Wi-Fi and make sure your battery is charged before you start. The same steps apply on iPad for iPadOS 27.2.1.
Related Guides
- iPhone XS and XR Owners: Install iOS 18.7.11 Now — It Fixes an Exploited Zero-Day
- Apple Wants Siri to Become a Real AI Agent — and the CEO Is Pushing for 2027
- WhatsApp Contacts Tab Rolling Out on Android Beta — See Who’s Online
FAQ
What does iOS 27.2.1 fix?
iOS 27.2.1 fixes nine security flaws across seven system components, including two iMessage bugs, four Bluetooth and AirPlay pairing bugs, and flaws in App Intents and the brotli compression library.
What is the iMessage flaw in iOS 27.2.1?
CVE-2026-113961 could let a remote attacker join an iMessage group chat without an invitation and receive its messages. A second flaw, CVE-2026-113960, could let someone newly added to a group read messages posted before they joined.
Which iPhones can install iOS 27.2.1?
iOS 27.2.1 is available for iPhone 11 and later. Older devices get iOS 26.7.3 or iOS 18.7.12, which cover handsets as old as the iPhone XS, iPhone XS Max and iPhone XR.
How big is the iOS 27.2.1 update?
The over-the-air download is roughly 1.48GB on an iPhone 18 Pro. Install it over Wi-Fi with your battery charged.
Does iOS 27.2.1 add any new features?
No. It is a bug-fix and security update only. The next feature update, iOS 27.3, is in public beta and is expected in December with a redesigned Health app.
Sources: Cult of Mac (Nov 10, 2026), iThinkDiff (Nov 10, 2026), Technobaboy (Nov 10, 2026); Apple security advisories via iThinkDiff.
