Two iMessage flaws could have exposed group chats in different ways: one could let an attacker join without an invitation, while the other could let a newly added member read messages sent before they arrived. Apple’s iOS 27.2.1 update fixes both.
Released on Monday evening and now available for compatible devices, the update adds no new features. According to 9to5Mac, it patches nine security vulnerabilities in total.
The first iMessage flaw could have allowed an uninvited attacker to enter a group conversation and receive the messages sent there. The second, identified as CVE-2026-113960, concerned access to chat history: someone newly added to a group could have read messages from before they joined. These are distinct privacy boundaries, covering who can enter a conversation and what they can see once inside.
Apple says it isn’t aware of attackers having exploited any of the listed vulnerabilities in practice. The described effects are potential consequences of the flaws, not reports of confirmed attacks.
Bluetooth also receives several fixes. One vulnerability could have allowed a malicious Bluetooth device to pair with a phone without the user’s involvement. Another could have let an attacker bypass the limit on pairing-code attempts.
The remaining fixes include a privacy flaw involving Siri and the Shortcuts app, a memory-corruption vulnerability in the Brotli compression library, and additional Bluetooth and AirPlay security vulnerabilities.
The source article recommends installing the available update on iPhones promptly, despite the lack of known exploitation. The security fixes aren’t limited to newer models: Apple has also released security updates for older devices that can’t run the latest operating system, with support extending back to the iPhone XS.
