Apple has released new security updates to fix several vulnerabilities affecting iMessage, Bluetooth, AirPlay, and Google’s Brotli compression library. Some of these issues could put user privacy and device security at risk.
The most concerning problems involve Apple iMessage security flaws that could allow an unauthorized person to join a group conversation or read messages sent before they became a member. Apple has addressed these issues through software updates.
iMessage Group Chat Flaws Could Expose Private Messages
Apple identified two security vulnerabilities in iMessage that could affect group chat privacy.
The first issue, tracked as CVE-2026-113961, could allow a remote attacker to join an iMessage group chat without proper authorization. If successful, the attacker might receive messages shared within that conversation.
The second vulnerability, CVE-2026-113960, could allow someone who has recently joined a group to access messages sent before they became a member.
Both issues are related to authorization checks. Apple fixed them by improving validation in its software.
However, Apple has not explained whether these vulnerabilities were actively exploited. It has also not confirmed whether other group members would notice an unauthorized person joining a conversation.
Which Apple Updates Include the Security Fixes?
Apple released separate updates for different operating system versions. The iOS and iPadOS 27.2.1 security advisory includes fixes for the two iMessage vulnerabilities and the Brotli issue.
Here is a quick comparison of the updates mentioned in the security notes:
| Apple Update | Security Details |
|---|---|
| iOS 27.2.1 | Fixes iMessage and Brotli vulnerabilities |
| iPadOS 27.2.1 | Includes the same three security fixes |
| iOS 18.7.12 | Lists other security fixes, but not these three |
| watchOS 26.6.1 | Does not list the iMessage or Brotli fixes |
Apple has not confirmed whether devices running iOS 18.7.12 or watchOS 26.6.1 are affected by these specific issues.
Brotli Vulnerability Also Receives a Fix
The updates also address a security problem in Google’s Brotli compression library, tracked as CVE-2026-111497.
This vulnerability involves an out-of-bounds write in the Brotli decoder. An attacker could potentially send specially crafted input that corrupts memory.
The US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on October 27, 2026.
Bluetooth and AirPlay Vulnerabilities Fixed
Apple’s security releases also address several Bluetooth and AirPlay problems.
Two vulnerabilities could allow a malicious Bluetooth device or an attacker within Bluetooth range to pair with an Apple device without requiring user interaction.
Other flaws could allow attackers to bypass pairing code attempt limits. One attack could work from Bluetooth range, while another could be launched from the same network.
Another vulnerability could allow an attacker nearby to corrupt process memory.
Apple has not shared full details about what an attacker could do after successfully exploiting these Bluetooth issues.
Why Apple Users Should Install Security Updates
These security fixes are important because they protect private conversations and reduce the risk of unauthorized device access.
Apple users should check their device settings and install the latest compatible security updates. Keeping software updated is one of the easiest ways to reduce exposure to known vulnerabilities.
With multiple issues affecting messaging, Bluetooth, and AirPlay, installing available updates promptly is a sensible step for protecting personal data and device security.