Apple's November 9 updates fix eight flaws, including one that let a remote attacker join an iMessage group chat and read it, and Bluetooth bugs that allowed pairing without user interaction. iOS 27.2.1, iOS 26.7.3, macOS 27.2.1, 26.7.3 and 15.8.3, watchOS 27.2.1 and visionOS 27.2.1 all carry the fixes. The Mac updates also stop curl and git from trusting the compromised eMudhra certificates.
Install iOS 27.2.1 on your iPhone and macOS 27.2.1 on your Mac today. Apple released them on November 9 with fixes for eight security flaws. The one to care about: a remote attacker could join an iMessage group chat and receive its messages. Apple’s notes do not say any of the flaws were used in attacks.
What Apple fixed
Apple lists the same eight flaws for iPhone, iPad and Mac in its iOS 27.2.1 security notes and its macOS Golden Gate 27.2.1 notes. The ones that matter for a work phone:
- Messages, CVE-2026-113961. “A remote attacker may be able to join an iMessage group chat and receive its messages,” Apple says. It fixed an authorization check. Credited to an anonymous researcher.
- Messages, CVE-2026-113960. Someone added to an iMessage group could read messages sent before they joined. Apple removed the vulnerable code.
- Bluetooth pairing, CVE-2026-113965 and CVE-2026-113964. A malicious Bluetooth device nearby could pair with your iPhone or Mac without you doing anything, in one case by getting around the limit on pairing code attempts.
- Bluetooth, CVE-2026-113970. An attacker in Bluetooth range could corrupt memory, the kind of bug that can lead to code running on the device.
- AirPlay and rapportd. Two flaws let an attacker in Bluetooth range or on the same network keep guessing AirPlay pairing codes past the rate limit.
The list also includes a memory corruption bug in the brotli compression library. iPhone and iPad get a ninth fix in App Intents, where an app could reach sensitive user data.
Who gets the fix
The fixes ship in every supported line, so you don’t have to move to the newest OS to get them:
| Device | Update |
|---|---|
| iPhone 11 and later, recent iPads | iOS and iPadOS 27.2.1 |
| Staying on iOS 26 | iOS and iPadOS 26.7.3 |
| Mac on macOS 27 | macOS Golden Gate 27.2.1 |
| Mac on macOS 26 or 15 | macOS Tahoe 26.7.3 or Sequoia 15.8.3 |
| Apple Watch, Vision Pro | watchOS 27.2.1, visionOS 27.2.1 |
Apple’s security releases page lists all of them with the same November 9 date. On iPhone, go to Settings > General > Software Update. On Mac, System Settings > General > Software Update.
Group chats with clients are the exposure
The iMessage bug is the reason not to wait for the weekend. Many founders run deal threads, board updates and client channels as iMessage groups, and Apple’s description means an outsider could sit in one and read along. Apple has not said whether it was used, how an attacker would do it, or whether the people in the chat would see the extra member. Until your devices and the people in your groups update, keep anything you would not forward out of iMessage groups, or move it to a tool where you control membership.
Macs also stop trusting the bad eMudhra certificates
The Mac updates close a gap we covered in October. Apple had blocked eight compromised eMudhra certificate authorities in Safari, Mail and its frameworks, but curl, git and python3 still trusted them. Apple’s eMudhra support note now says that starting in macOS 27.2.1, those command-line tools stop accepting the certificates, and that macOS 26.7.3 and 15.8.3 include the same protection. If your team pulls code from the Mac terminal and IT applied Apple’s manual workaround, the update makes it permanent.
This is a security-only release on top of iOS 27.2 and macOS 27.2, which brought Siri AI to more languages last month.