Apple released iOS 27.2.1, iPadOS 27.2.1, and macOS 27.2.1 on Monday with fixes for several security vulnerabilities. The most concerning flaws involve iMessage, where one bug could let a remote attacker join a group chat and receive its messages. A second iMessage flaw could let users see messages sent before they joined a group conversation. Together, these two bugs undermined the privacy assumptions behind group messaging on Apple devices.
The majority of remaining vulnerabilities center on AirPlay and Bluetooth. One Bluetooth flaw allowed a malicious device to pair with an iPhone or iPad without any user interaction. Another Bluetooth bug let a nearby attacker corrupt process memory on the target device.
On the AirPlay side, several vulnerabilities allowed attackers to bypass the rate limit on pairing code attempts. In other words, an attacker could brute-force AirPlay pairing codes without the usual throttling that prevents rapid guessing.
Apple found four of the vulnerabilities internally, which suggests the company’s own security team caught them before outside researchers did.
However, Apple did not say whether any of these flaws had been exploited in the wild. Now that the details are public through Apple’s security content pages, unpatched devices face a higher risk of targeted attacks.
The macOS 27.2.1 update carries an additional fix that developers and system administrators have been waiting for. Apple finally addressed the eMudhra certificate vulnerability in command line tools. Back in October, security researchers discovered that the private keys of eight intermediate certificate authorities operated by Indian company eMudhra had been compromised. Anyone holding those keys could forge valid HTTPS certificates for any website.
Apple blocked the compromised certificates in Safari, Mail, and apps using its networking frameworks on October 19. However, command line tools like Git, curl, Python 3, Ruby, Perl, and OpenSSL continued accepting the compromised certificates. These tools validate certificates against a separate file that does not check Apple’s block list or revocation status. Consequently, the macOS 27.2 update released on October 26 still left this gap open. Developers who used Git to pull code or curl to download packages remained exposed to potential man-in-the-middle attacks. The macOS 27.2.1 update now closes that gap with protections for command line tools.
Apple recommends updating all devices as soon as possible. Users can install the update through Settings, then General, then Software Update on iPhone and iPad.
On Mac, the update appears under System Settings, then General, then Software Update.
