Abstract:
Apple recently released an update to iOS 27.2.1. This update mainly fixes known issues and security vulnerabilities. Of particular concern are security vulnerabilities involving iMessage group chats and Bluetooth pairing, which may pose privacy risks.
Considering the recent poor state of Internet security, iPhone users are advised to immediately update to the latest version of iOS to fix vulnerabilities. Some vulnerabilities in older versions may be discovered by AI at some point and then used by hackers to launch attacks.
Security vulnerabilities in iMessage:
CVE-2026-113961: This vulnerability is located in the messaging component. A remote attacker may exploit an authorization verification issue to join an iMessage group chat and receive group chat messages. The vulnerability affects users who use groups to discuss family, work or other private matters. For example, private information may be stolen by hackers. Apple has fixed this issue by improving the verification mechanism.
CVE-2026-113960: This vulnerability also affects iMessage group chats. Apple said that new members added to the group chat may access historical messages in the group, but the normal design is that new members cannot view historical messages. Apple has now fixed the problem of new members accessing historical messages by removing the problematic code.
Bluetooth and AirPlay pairing issues:
In this update, Apple also fixed a number of security vulnerabilities related to wireless connections, including Bluetooth device pairing, Bluetooth process memory corruption, and bypassing restrictions related to AirPlay pairing codes. These problems may lead to social engineering attacks (because hackers need to be close to the user).
CVE-2026-113965: This vulnerability allows malicious Bluetooth devices to complete pairing without user interaction, that is, the user is connected to other unknown Bluetooth devices without their knowledge.
CVE-2026-113964: This vulnerability allows an attacker to bypass the limit on the number of pairing code attempts within Bluetooth communication range and complete pairing to connect to an unknown or attacker-controlled device without user interaction.
CVE-2026-113968: This vulnerability also involves the problem of limiting the number of pairing code attempts. CVE-2026-113969 is also a similar issue where the number of pairing code attempts is bypassed.
Other issues include repairing Bluetooth process memory corruption. If this vulnerability is successfully exploited, it may cause more problems, such as out-of-bounds execution. However, Apple did not detail the possible consequences of Bluetooth process memory corruption in the security advisory.
Both the old and new versions need to be updated:
Apple has fixed the above security vulnerabilities through iOS 27.2.1. Many older devices have not or cannot be updated to the iOS 27.x series, so Apple has also ported the fixes to iOS 26.x and iOS 18.x, so users using these older versions also need to update.
The latest version of iOS 26.x is iOS 26.7.3, and the latest version of iOS 18.x is iOS 18.7.12. There have been many DarkSword attacks against these old versions recently, and users are strongly recommended to upgrade to the latest version immediately.
Comments