iPhones and Macs could pair with a nearby device without a tap. Require iOS 27.2.1 this week

Apple’s Monday updates fix a Bluetooth bug that lets a nearby device pair with an iPhone or Mac without anyone tapping “Pair,” and an iMessage bug that lets an outsider join a group chat and read it.

The same updates carry Apple’s fix for the Brotli decompression bug that attackers have been using against servers since October.

A nearby device could pair with your iPhone without a tap, and a stranger could join your iMessage group. iOS 27.2.1 and 26.7.3 fix both.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Apple closes Bluetooth pairing and iMessage group bugs

Apple released iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, plus watchOS and visionOS updates, on November 9.

• CVE-2026-113965: a malicious Bluetooth device could pair without user interaction.
• CVE-2026-113964: an attacker in Bluetooth range may bypass the pairing-code rate limit and pair without user interaction.
• CVE-2026-113961: a remote attacker could join an iMessage group chat and receive its messages. CVE-2026-113960 let new group members read messages sent before they joined.
• CVE-2026-111497: the Brotli out-of-bounds write, fixed in iOS 27.2.1 and macOS.

Apple does not say any of these were exploited against its devices. Hong Kong’s GovCERT still rated the release a high threat, citing reports that CVE-2026-111497 is being exploited in the wild.

iPhones, iPads and Macs that skipped this week’s update

We covered the Brotli bug when it was exploited on servers on October 28. On phones and Macs, the Bluetooth and iMessage bugs are the more practical risk. One needs only someone nearby. The other exposes a group chat to someone outside it.

MacRumors notes that once fix details are public, unpatched devices become easier targets. The iMessage bug also means a group stays exposed until every member updates, since the fix is on the device side.

Require iOS 27.2.1 or 26.7.3 in your MDM

• In your MDM, require iOS 27.2.1 (or 26.7.3 or 18.7.12 on older models) and macOS 27.2.1, 26.7.3 or 15.8.3, with a short deadline.
• Report on devices still below those builds a week from now, and follow up with their owners.
• For executives and anyone who travels, ask them to update before their next flight or conference, where Bluetooth range is crowded.
• Remind teams that use iMessage groups for work to check the member list.

Details

• Releases (November 9, 2026): iOS/iPadOS 27.2.1, 26.7.3, 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3, Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; visionOS 27.2.1.
• Bluetooth: CVE-2026-113965, CVE-2026-113964, CVE-2026-113970 (use-after-free, memory corruption from Bluetooth range).
• Messages: CVE-2026-113961, CVE-2026-113960.
• AirPlay pairing rate limit: CVE-2026-113968, CVE-2026-113969.
• brotli: CVE-2026-111497 (not listed in the iOS 18.7.12 notes).

Hunt / verify

• Export your MDM device list with OS build and sort by oldest.
• On managed Macs, review the list of paired Bluetooth devices for anything nobody recognizes.

Source: Apple security notes, iOS 27.2.1; GovCERT.HK alert

Sources

• Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1
• Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3
• Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12
• Apple: About the security content of macOS Tahoe 26.7.3
• GovCERT.HK: High Threat Security Alert A26-11-14, Multiple Vulnerabilities in Apple Products
• MacRumors: Here’s What Apple Fixed in iOS 27.2.1 and macOS 27.2.1

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].