Apple has released security updates for iPhones, iPads, Macs, Apple Watches and Vision Pro headsets. The fixes matter at home because the flaws could expose iMessage group conversations or let a nearby attacker pair with an Apple device without the owner approving it.
What happened
According to The Hacker News, one authorization flaw could allow a remote attacker to enter an iMessage group and receive its messages. A second flaw could reveal older parts of a group conversation to someone added after those messages were sent.
Apple’s public notes do not explain what an attacker would need to exploit the iMessage issues. They also do not say whether existing group members would notice an unauthorized participant or whether everyone in the group must install the update before the conversation is protected.
The releases also address several problems involving Bluetooth and AirPlay pairing. SecurityWeek reports that some of the flaws could let a malicious Bluetooth device pair without user action or could allow someone nearby to keep guessing pairing codes beyond the normal limit. Another pairing-code issue requires the attacker to share the same network.
The updates also include a fix for a flaw in the Brotli compression library. The U.S. Cybersecurity and Infrastructure Security Agency had already placed that flaw in its catalog of vulnerabilities known to be exploited, although the sources report no evidence that Apple products were targeted through it. Apple’s advisories did not report attacks using the newly fixed Apple flaws.
Who is affected
The iMessage fixes are included in iOS and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1, according to The Hacker News.
Apple also issued iOS and iPadOS 26.7.3 and 18.7.12, plus watchOS 26.6.1. Those releases contain Bluetooth and AirPlay fixes, but the available notes for iOS 18.7.12 and watchOS 26.6.1 do not list the two iMessage fixes or the Brotli repair. The sources say Apple has not disclosed whether devices limited to those versions are vulnerable to those three issues.
The iOS and iPadOS 18.7.12 update covers the iPhone XS, XS Max and XR, along with the seventh-generation iPad. Apple has not disclosed complete affected-model details for every flaw in the provided reports.
What to do now
On each iPhone or iPad, open Settings > General > Software Update. Install the newest version offered for that device.
On a Mac, open System Settings > General > Software Update, check for an update and install it. Save open work first because the Mac may need to restart.
Update Apple Watches through Settings > General > Software Update on the watch, or use the Watch app on the paired iPhone. Update a Vision Pro through Settings > General > Software Update.
Check every Apple device in the household separately. An older phone, shared iPad or rarely used watch may receive a different release from a newer device.
Review important iMessage group chats after updating. If an unfamiliar participant appears, remove that account from the group and begin a new conversation with the intended members.
Treat unexpected Bluetooth or AirPlay pairing prompts as suspicious. Decline the request, move away from the area if possible and confirm that the device has installed its latest available update.
Sources
- Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities — The Hacker News
- Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms — SecurityWeek
Written by the CyberSec24 news desk with AI assistance, from the sources above. Spot an error? Tell us and we'll correct it.