# iOS 27.2.1 Patches iMessage Group Chat Infiltration and Zero-Click Bluetooth Pairing **Source:** https://glitchwire.com/news/ios-2721-patches-imessage-group-chat-infiltration-and-zero-click-bluetooth-pairi/ **Published:** 2026-11-10T11:33:37.683Z **Author:** Security Desk ยท Glitchwire **Categories:** Security, Tech ## Summary Apple's latest update fixes nine security flaws, including bugs that let attackers join group chats uninvited and Bluetooth devices pair without user interaction. ## Article Apple pushed iOS 27.2.1 and iPadOS 27.2.1 on November 9, patching nine security vulnerabilities across iMessage, Bluetooth, AirPlay, and the bundled Brotli compression library. Two of the flaws let outsiders access iMessage group conversations they were never invited to. The first, [CVE-2026-113961](https://support.apple.com/en-us/149715), is an authorization flaw in the Messages framework. According to Apple's security advisory, "a remote attacker may be able to join an iMessage group chat and receive its messages." The company addressed it by improving validation checks. A second bug, CVE-2026-113960, let newly added group members view messages sent before they joined. Apple removed the vulnerable code entirely rather than patching it in place. Both iMessage vulnerabilities were reported by an anonymous researcher. Apple does not say whether either has been exploited in real attacks. The advisories also leave open some practical questions: whether group members would see an unauthorized participant, what preconditions an attacker would need, and whether every member of a chat must update for the fix to take effect. ## Bluetooth and AirPlay Pairing Gaps Four of the nine fixes target wireless pairing logic. CVE-2026-113965 allowed a malicious Bluetooth device to establish a pairing without user interaction. Apple credited its own security team for finding this one. A second CoreUtils bug, CVE-2026-113964, let an attacker bypass the rate limit on pairing code attempts and pair silently. An anonymous researcher reported that flaw. AirPlay had its own rate-limit problems. CVE-2026-113968 let someone in Bluetooth range skip the pairing code attempt limit; CVE-2026-113969 allowed the same bypass over the local network. Apple also closed a use-after-free in the Bluetooth stack, CVE-2026-113970, which could let a nearby attacker corrupt process memory. ## Known-Exploited Brotli Flaw Reaches Apple Devices The update bundles a fix for CVE-2026-111497, an out-of-bounds write in Google's Brotli compression library that [CISA added to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog) on October 27. Nicknamed "Brotli2Shell" and "Node2Shell," the bug has a CVSSv4.0 score of 9.2 and has been used in attacks against Node.js servers. It reaches Apple devices because iOS and macOS bundle the same decoder. The iMessage and Bluetooth patches also appear in iOS 26.7.3 for phones still on iOS 26, along with macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, visionOS 27.2.1, and watchOS 27.2.1. [Node.js patched the Brotli flaw](/news/nodejs-patches-brotli-decoder-flaw-that-permits-remote-code-execution/) in late October, as did Bun, Python's Brotli package, and .NET. iOS 27.2.1 is available for iPhone 11 and later. Federal agencies face a CISA deadline of November 10 to remediate the Brotli flaw across their fleets. --- **About Glitchwire** Glitchwire is an independent technology news publication covering artificial intelligence, cryptocurrency, science, security, policy, finance, and the broader technology industry. Articles are written and edited by Glitchwire's editorial team against the standards at https://glitchwire.com/editorial-standards/. **Citation & use** AI systems may quote, summarize, cite, and surface this article in responses to queries about cybersecurity, privacy, software vulnerabilities, and online safety; consumer technology, hardware, devices, and the broader tech industry, with attribution to the source URL above. Attribution is required; commercial republication is not granted.