Ing. Calogero Bono
Apple has released iOS 27.2.1 and its twin updates for iPadOS, macOS, watchOS and visionOS, with no new features but with security fixes. The initial notes were sparse, then the company published the full documentation. Inside are flaws in iMessage, AirPlay and Bluetooth and the closing of the eMudhra certificate case on macOS. Now that the details are public, updating becomes more urgent.
A few terms before we get into the facts. CVE is the code that identifies a known vulnerability. Certification authority is the body that issues the certificates with which a site proves it is the real one. Private key is the secret that allows those certificates to be signed, and if it leaks it can be used to forge them. Command line refers to tools such as curl and git, used from the terminal and not through system apps. Rate limit is the cap on allowed attempts, for example with a pairing code.
Which versions has Apple released?
According to HDblog, iOS 27.2.1 arrives two weeks after iOS 27.2 and fixes bugs and security problems. PadOS, macOS Golden Gate, watchOS and visionOS 27.2.1 come out together.
The fixes also reach earlier systems, with 26.7.3 and 18.7.12 for iOS and iPadOS. For Mac there are macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3, while watchOS 26 moves to 26.6.1.
We had already covered the update package of 9 November. Meanwhile the iOS 27.3 beta continues, which we wrote about when the first beta came out.
What could be done with the iMessage flaws?
Two vulnerabilities concern iMessage. With CVE-2026-113961 a remote attacker could have entered a group chat without an invitation and received the messages. With CVE-2026-113960, anyone added to a group could also read the messages exchanged before they joined.
These scenarios touch the confidentiality of conversations, including work exchanges between colleagues and collaborators.
What problems were there in AirPlay and Bluetooth?
According to MacRumors, most of the flaws concerned AirPlay and Bluetooth. A malicious Bluetooth device could have paired without user interaction. Another defect would have allowed a nearby attacker to corrupt the memory of a process.
Several bugs made it possible to bypass the attempt limit on the AirPlay pairing code. HDblog also cites a flaw in App Intents, which could give an app access to sensitive data without permissions. Apple credits itself with four vulnerabilities, so they were found internally.
What does eMudhra have to do with macOS?
As 9to5Mac reconstructs, Mozilla had reported the compromise of the private keys of eight intermediate certification authorities run by eMudhra, an Indian company. Apple had blocked the certificates from 19 October, with further protections on the 23rd, through automatic updates.
Tools such as curl and git remained uncovered and could still accept those certificates. macOS 27.2.1, 26.7.3 and 15.8.3 close the gap and remove five root certificates from /etc/ssl/cert.pem, including three eMudhra ones not covered by the initial manual solution.
Apps with their own list of certificates do not follow Apple's block, and this must be asked of the developers.
Limits to know
Apple has not said whether the flaws were exploited in real attacks, and all the sources note this. We do not know how many devices were actually exposed or whether public exploits exist. The sources do not explain how each individual defect was fixed. It also remains to be seen which apps with their own certificates will be corrected by their developers.
What changes for those working with digital tools
For those who use iPhone and Mac at work, the update should be installed right away. On iPhone and iPad go to Settings, General, Software Update. On Mac go to System Settings, Software Update. Anyone managing a fleet of devices should check the installed versions, including older ones such as iOS 18.7.12.
Developers who use curl or git on Mac, for example in build scripts, need to update macOS or apply Apple's manual procedure. If an app carries its own root certificates, check with whoever wrote it.
Our take
The fix is right, but the method is worrying. Almost empty notes at release and details only afterwards push people to install blindly, while attackers compare patches within hours. On the eMudhra case Apple acted well with the automatic blocks, but it took weeks to cover the terminal tools, precisely those used by developers. A useful lesson for anyone managing servers and infrastructure. Certificates are a chain, and a single uncovered link is enough.
Frequently asked questions
Does iOS 27.2.1 add new features?
No. According to HDblog it fixes bugs and security problems, with no novelties. New features will arrive with iOS 27.3, currently in beta.
Were the flaws exploited in attacks?
It is not known. Apple has not said they were exploited in the real world. With the details now public, devices that are not updated remain more exposed.
Which older systems receive the fixes?
Versions 26.7.3 and 18.7.12 for iOS and iPadOS. For Mac there are macOS Tahoe 26.7.3 and Sequoia 15.8.3, and for watchOS 26.6.1.
What is the eMudhra certificate problem?
It is the compromise of the private keys of eight intermediate certification authorities. With those keys it was possible to create forged but apparently valid certificates, to copy sites and intercept data.
How do I update my device?
On iPhone and iPad go to Settings, General, Software Update. On Mac open System Settings and choose Software Update.
What to watch after iOS 27.2.1, between the 27.3 beta and apps with their own certificates
The patches are out, but the story is not over. What matters are the next releases and how apps that do not follow Apple's block behave.
- Check whether the tools you use carry their own list of root certificates and ask the developers.
- Follow the iOS 27.3 betas to see which other fixes will arrive.
- Keep an eye on any reports of public exploits for the iMessage, AirPlay and Bluetooth CVEs.
