Apple's iOS 27.2.1 Fixes an iMessage Flaw That Let a Remote Attacker Join a Group Chat and Read It, Plus Bluetooth Pairing Bypasses and the Brotli Bug CISA Lists as Exploited. Update Now
Open Settings, then General, then Software Update, and install iOS or iPadOS 27.2.1 on every iPhone and iPad that can take it. Apple released it on Monday, November 9, with nine security fixes. Two are iMessage group-chat flaws, five touch Bluetooth or AirPlay pairing, and one is the Brotli decompression bug that CISA already lists as exploited and gave federal agencies until today to patch. Apple's page does not say any of these were exploited on Apple devices.
What has been reported
The primary source is Apple's security notes for iOS and iPadOS 27.2.1, which we read in full via an agent. The Hacker News (Swati Khandelwal, November 10) adds the other platforms' updates, which we did not read ourselves.
- iMessage, CVE-2026-113961: "a remote attacker may be able to join an iMessage group chat and receive its messages." Credited to an anonymous researcher. Apple does not say how the attacker gets in or whether they need to know the group.
- iMessage, CVE-2026-113960: a person added to a group may be able to read messages sent before they joined. Apple says it fixed it by removing the vulnerable code. Same credit.
- Bluetooth and AirPlay pairing, five fixes: CVE-2026-113965 (a malicious Bluetooth device may pair without user interaction), CVE-2026-113964 (an attacker in Bluetooth range may bypass the pairing-code attempt limit and pair without user interaction), CVE-2026-113968 (the same rate-limit bypass in AirPlay, in Bluetooth range), CVE-2026-113969 (a rate-limit bypass for AirPlay pairing codes from the same network) and CVE-2026-113970 (a use-after-free in Bluetooth that may corrupt process memory). Four are credited to Apple itself or to an anonymous researcher.
- App Intents, CVE-2026-113963: an app may be able to access sensitive user data. Credited to an individual researcher. Apple does not link it to the public sandbox escape we covered earlier on November 10, and neither do we.
- Brotli, CVE-2026-111497: processing a crafted stream may lead to memory corruption. This is the same identifier as the Google Brotli flaw CISA added to its exploited-vulnerabilities catalog on October 27, with a federal deadline of November 10 (read from the CISA JSON today). We wrote about the Node.js side of it on October 22. No report we read says it was used against Apple devices.
- Devices: Apple lists iPhone 11 and later and the iPad models from iPad 9th generation, iPad mini 6th generation, iPad Air 4th generation and iPad Pro 11-inch 2nd generation and 12.9-inch 4th generation on. The Hacker News says other releases (iOS 18.7.12, watchOS 26.6.1 and more) carry fixes but that some older devices are not listed as fixed. We did not read those pages.
What it means
None of these is reported as exploited, so this is not an emergency on its own. The reason to move today is the mix: pairing bypasses need an attacker physically nearby, the group-chat flaw needs only a remote attacker, and the Brotli bug is exploited elsewhere and any memory bug in a decompression library is the kind attackers reuse. Apple's notes give no step-by-step, and we are not adding one.
What to do
- Update iPhones and iPads to 27.2.1 now. Turn on automatic updates.
- If a device is too old for 27.2.1, check Apple's security releases page for the update that applies to it, and plan to replace anything that gets none.
- In iMessage, review your group chats. Remove any member you do not recognise, and treat the history of a sensitive group as possibly readable by a person who should not have seen it. Do not discuss credentials or codes in groups.
- Turn Bluetooth off in places where you handle sensitive work, and remove paired devices you no longer use.
- In a managed fleet, push 27.2.1 and confirm the version from MDM, not from the user.
- If you run Node, make sure the October 21 Node.js releases are applied too, since the Brotli bug exists in more than one product.
What is not known
Whether any of these has been used against anyone. Who the anonymous researcher is. How an attacker would join an iMessage group, and whether the exposure needs a prior relationship to a member. Whether the App Intents fix is related to the public sandbox escape. What the older-device updates contain, because we did not read them. We add no indicators to our feed: none are published and these are device bugs.
How we know, and how we checked
We read Apple's iOS and iPadOS 27.2.1 security notes (through an agent that read the page and reported it to us), the CISA KEV JSON today for the Brotli entry, and The Hacker News report for the other platforms. We did not test any flaw. A search of our corpus found our October 22 Node.js Brotli post and no post on Apple's November 9 releases.
Sources
Apple, "About the security content of iOS 27.2.1 and iPadOS 27.2.1," November 9, 2026. The Hacker News, "Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities," November 10, 2026. CISA Known Exploited Vulnerabilities catalog, read November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.