This article may contain affiliate links. Learn more on our Partner Program page.
With iOS 27.2.1, Apple didn't release any new features, but instead a short, yet unusual, list of security vulnerabilities. A remote attacker could join and read iMessage group conversations, and several other vulnerabilities affect pairing via Bluetooth and AirPlay.
On the evening of November 9th, Apple released iOS 27.2.1, macOS 27.2.1, and other updates, initially without specifying the security content. The documentation is now available in Apple's overview. Apple lists nine vulnerabilities in iOS 27.2.1 and iPadOS 27.2.1.
Across all nine documents, there are ten different vulnerabilities. For comparison, the updates from October 26th closed 329 different security vulnerabilities. All articles about this version are compiled on the iOS 27.2.1 topic page.
Key Facts at a Glance
- iOS 27.2.1 and iPadOS 27.2.1 close nine vulnerabilities; across all systems, there are ten different ones.
- An attacker was able to remotely join an iMessage group conversation and receive its messages via a vulnerability in messaging software.
- Four entries relate to pairing via Bluetooth and AirPlay, sometimes without user intervention.
- Apple makes no mention of any attacks in connection with any of the vulnerabilities.
- iPhones with iOS 26 and iOS 18, as well as Macs with macOS Tahoe and Sequoia, will also receive fixes.
Strangers in group conversation
The most notable entries concern messages. A remote attacker was able to join an iMessage group conversation and receive its messages. Apple describes the cause as a permissions issue, which has been resolved with stricter checks.
A second vulnerability in the same app affected people added to a group. They could see messages sent before they joined. Apple has removed the affected code.
Apple fixed both bugs in iOS 27.2.1, iOS 26.7.3, the three Mac updates, watchOS 27.2.1, and visionOS 27.2.1. They do not appear in the list for iOS 18.7.12.
Coupling without consent
Four entries relate to device pairing. In two cases, an attacker within Bluetooth range could bypass the limit on pairing attempts; in one of these cases, a device could even be paired without user interaction. Another allowed a malicious Bluetooth device to pair without user interaction.
In addition, there is a vulnerability that allowed an attacker on the same network to bypass the limit on attempts using the AirPlay code. A flaw in the Bluetooth system itself could also corrupt a process's memory. The ninth vulnerability lies in a data compression component, through which manipulated input could corrupt memory.
Only in iOS 18.7.12 for older devices is there a tenth fix: With physical access, a device could be paired with an AirPlay receiver from the lock screen.
Mac: Terminal tools reject eMudhra certificates
On Macs, macOS 27.2.1 includes an additional fix that is not listed in the security patch list. Since this version, command-line tools like curl and git no longer accept the compromised certificates from the provider eMudhra, as Apple explains in its support document on affected certificate authorities. For Macs with older operating systems, macOS 26.7.3 and macOS 15.8.3 contain the same protection.
Safari, Mail, and apps that use Apple's network and security frameworks have been blocking the certificates since October. However, some tools in the Terminal check against a separate system certificate file and continued to accept the certificates until this update. Users who cannot update their Macs can find instructions in Apple's documentation on how to manually remove the affected root certificates from this file.
Which devices get what
| Update | Devices according to Apple | Gaps |
|---|---|---|
| iOS 27.2.1 and iPadOS 27.2.1 | iPhone 11 and later, iPad (9th generation) and later | 9 |
| iOS 26.7.3 and iPadOS 26.7.3 | iPhone 11 and newer, iPad (8th generation) and newer | 8 |
| iOS 18.7.12 and iPadOS 18.7.12 | iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation) | 6 |
| macOS Golden Gate 27.2.1 | Macs with macOS Golden Gate | 8 |
| macOS Tahoe 26.7.3 | Macs with macOS Tahoe | 8 |
| macOS Sequoia 15.8.3 | Macs with macOS Sequoia | 8 |
| watchOS 27.2.1 | Apple Watch Series 9 and newer | 9 |
| watchOS 26.6.1 | Apple Watch Series 6, Series 8, SE (1st and 2nd Generation), Ultra | 5 |
| visionOS 27.2.1 | Apple Vision Pro (all models) | 9 |
The iPad specifications are abbreviated; the devices listed also include the iPad Pro, iPad Air, and iPad mini of the respective generations. There is no update for tvOS.
Only iOS 27.2.1, watchOS 27.2.1, and visionOS 27.2.1 additionally fix a bug in App Intents that allowed an app to access sensitive user data. It is not listed for macOS Golden Gate 27.2.1.
Why the short list carries more weight than it seems
Ten vulnerabilities are a small number compared to the 329 from October. Nevertheless, I believe this update is one that shouldn't be ignored. The vulnerability in group conversations hits precisely where many people conduct their most private conversations, and an attacker could exploit it remotely.
Pairing errors, on the other hand, require proximity, be it Bluetooth range or the same network. Those who travel frequently—on trains, in cafes, or in offices with other devices nearby—benefit more from this than someone who uses their iPhone almost exclusively at home. Information on how Apple distributes security updates and how to install them automatically can be found in the overview of Apple's security updates.
Do you have iMessage group conversations with people you barely know, perhaps from your club or work, and do you take a closer look at who's reading along after this discovery? Tell us in the comments how you deal with such groups.
