Apple pushed iOS 27.2.1 and iPadOS 27.2.1 on November 9, patching nine security vulnerabilities across iMessage, Bluetooth, AirPlay, and the bundled Brotli compression library. Two of the flaws let outsiders access iMessage group conversations they were never invited to.
The first, CVE-2026-113961, is an authorization flaw in the Messages framework. According to Apple's security advisory, "a remote attacker may be able to join an iMessage group chat and receive its messages." The company addressed it by improving validation checks. A second bug, CVE-2026-113960, let newly added group members view messages sent before they joined. Apple removed the vulnerable code entirely rather than patching it in place.
Both iMessage vulnerabilities were reported by an anonymous researcher. Apple does not say whether either has been exploited in real attacks. The advisories also leave open some practical questions: whether group members would see an unauthorized participant, what preconditions an attacker would need, and whether every member of a chat must update for the fix to take effect.
Bluetooth and AirPlay Pairing Gaps
Four of the nine fixes target wireless pairing logic. CVE-2026-113965 allowed a malicious Bluetooth device to establish a pairing without user interaction. Apple credited its own security team for finding this one. A second CoreUtils bug, CVE-2026-113964, let an attacker bypass the rate limit on pairing code attempts and pair silently. An anonymous researcher reported that flaw.
AirPlay had its own rate-limit problems. CVE-2026-113968 let someone in Bluetooth range skip the pairing code attempt limit; CVE-2026-113969 allowed the same bypass over the local network. Apple also closed a use-after-free in the Bluetooth stack, CVE-2026-113970, which could let a nearby attacker corrupt process memory.
Known-Exploited Brotli Flaw Reaches Apple Devices
The update bundles a fix for CVE-2026-111497, an out-of-bounds write in Google's Brotli compression library that CISA added to its Known Exploited Vulnerabilities catalog on October 27. Nicknamed "Brotli2Shell" and "Node2Shell," the bug has a CVSSv4.0 score of 9.2 and has been used in attacks against Node.js servers. It reaches Apple devices because iOS and macOS bundle the same decoder.
The iMessage and Bluetooth patches also appear in iOS 26.7.3 for phones still on iOS 26, along with macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, visionOS 27.2.1, and watchOS 27.2.1. Node.js patched the Brotli flaw in late October, as did Bun, Python's Brotli package, and .NET.
iOS 27.2.1 is available for iPhone 11 and later. Federal agencies face a CISA deadline of November 10 to remediate the Brotli flaw across their fleets.
