iOS 27.2.1 fixes iMessage group chat and Bluetooth pairing flaws: update your iPhone

The skim

• Update now: Apple released iOS 27.2.1 and iPadOS 27.2.1 on Nov. 9 for the iPhone 11 and later. Go to Settings > General > Software Update.
• What it fixes: Apple's security notes list nine fixes, including an iMessage bug that could let a remote attacker join a group chat and receive its messages, and several Bluetooth and AirPlay pairing flaws that someone nearby could abuse.
• Older iPhones too: iOS 26.7.3 and iOS 18.7.12 (iPhone XS, XS Max and XR) arrived the same day, along with watchOS 27.2.1, macOS Golden Gate 27.2.1 and visionOS 27.2.1. Apple doesn't say any of these flaws were exploited in the wild.

What iOS 27.2.1 fixes

Apple's release notes for the update are short: "This update provides bug fixes and security updates for your iPhone." The details are in Apple's security document for iOS 27.2.1 and iPadOS 27.2.1, which lists these issues:

• Messages (two fixes): "A remote attacker may be able to join an iMessage group chat and receive its messages" (CVE-2026-113961), and "A user added to an iMessage group may be able to access messages sent before they joined" (CVE-2026-113960). Apple says it fixed the second one by removing the vulnerable code.
• Bluetooth pairing (CoreUtils, two fixes): a malicious Bluetooth device "may be able to establish a pairing without user interaction," and an attacker in Bluetooth range could bypass the limit on pairing-code attempts and pair without user interaction.
• AirPlay pairing (two fixes): attackers in Bluetooth range, or on the same network, could get around the rate limit on AirPlay pairing-code attempts.
• Bluetooth memory bug: an attacker in Bluetooth range "may be able to corrupt process memory."
• App Intents: "An app may be able to access sensitive user data."
• brotli: processing maliciously crafted input could cause memory corruption.

Many of the Bluetooth and AirPlay flaws need an attacker nearby or on your Wi-Fi network, which limits who's at risk. The iMessage group chat flaw is listed as exploitable by a remote attacker. Apple hasn't published more technical detail, as usual.

Which devices get it

According to Apple's security releases page, iOS 27.2.1 is available for the iPhone 11 and later, plus supported iPads, including the iPad 9th generation and later, iPad mini 6th generation and later, and iPad Air 4th generation and later. iPhones and iPads still on iOS 26 get iOS 26.7.3, and the iPhone XS, XS Max and XR get iOS 18.7.12. Apple also published security notes for watchOS 27.2.1 (Apple Watch Series 9 and later), watchOS 26.6.1, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3 and visionOS 27.2.1.

How to install it

Apple's steps: back up your iPhone, plug it in and connect to Wi-Fi, then open Settings > General > Software Update and tap Download and Install. Apple notes that once installed, iOS updates can't be downgraded.

If you'd rather not think about it, turn on Settings > General > Software Update > Automatic Updates > Automatically Install. Apple says your iPhone will then install updates overnight while it's charging and on Wi-Fi, and it notifies you first. For a full walkthrough, including what to do if the update won't appear, see our guide to updating your iPhone to the latest iOS version.

What's next

iOS 27.2.1 has no new features. 9to5Mac notes that iOS 27.3, currently in beta, is the next feature update.

Sources: Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 (read Nov. 9), Apple security releases (read Nov. 9), Apple: Update your iPhone or iPad, 9to5Mac (Nov. 9), MacRumors (Nov. 9).