Overview
- Apple released unannounced security updates on Tuesday for iOS/iPadOS 27.2.1, macOS 27.2.1 and matching patches for watchOS 27.2.1, visionOS 27.2.1 plus several older iOS and macOS builds to close multiple high-risk bugs.
- Several bugs let attackers within Bluetooth or AirPlay range bypass pairing-code rate limits so they could brute-force or pair without user consent and one Bluetooth flaw could corrupt process memory, which raises the risk of further exploitation.
- A Messages (iMessage) vulnerability could allow a remote actor to join group chats, read past messages and send messages before becoming an approved member, and Apple patched App Intents flaws that could expose sensitive data to apps.
- Apple extended fixes to macOS components after Mozilla disclosed that eight intermediate keys from Indian CA eMudhra were compromised in October, a problem that could let an attacker issue forged TLS certificates that appear trusted by affected systems.
- There are no confirmed widespread exploits for the Apple-specific bugs so far but Brotli compression attacks are active elsewhere, so users and administrators should install the updates immediately and watch for new exploit reports.