iOS 27.2.1 Fixes Nine Flaws in iMessage, Bluetooth and AirPlay

Two iMessage bugs in group chats

The most notable fixes concern iMessage. According to Apple's security bulletin, the first flaw let a remote attacker join an iMessage group conversation and receive its messages without authorization. The second let a user added to a group read all messages sent before they joined. An anonymous researcher found both issues.

Bluetooth and AirPlay

Several Bluetooth problems were also patched. The most serious allowed a Bluetooth device to pair with an iPhone without the owner doing anything, which could open the door to malware. Another flaw let an attacker within Bluetooth range bypass the limit on pairing code attempts, making it possible to try codes repeatedly until one worked. A similar flaw was fixed in AirPlay.

Exploiting the Bluetooth flaws requires the attacker to be within range of the target. For AirPlay, being on the same Wi-Fi network is enough. Apple also fixed a Bluetooth memory corruption bug that could let an app access sensitive data, and a bug in brotli, a data compression library.

What to do

There is no indication that any of these flaws were exploited in real attacks. Still, attackers often study published security bulletins to build exploits, so installing the update promptly is advisable. To do so, open Settings, then General, then Software Update.