On Nov 10, Apple began rolling out iOS 27.2.1 and macOS 27.2.1, patching multiple security flaws on iPhone and Mac devices. iOS 27.2.1 (internal build 24B156) is a minor maintenance release focused on bug fixes and security updates; macOS 27.2.1 (Golden Gate) addresses a lingering eMudhra certificate trust issue in command-line tools.
iOS 27.2.1: nine vulnerabilities fixed, with focus on iMessage and Bluetooth
Apple's release notes say only that the update "provides bug fixes and security updates for iPhone," without listing specific vulnerabilities. But tech outlet lifehacker reported that the update fixes nine security flaws, two of them in Message, with the most notable involving iMessage group-chat permissions and Bluetooth/AirPlay pairing.
According to the disclosed vulnerability details, iMessage had two authorization issues: a remote attacker could join an iMessage group chat and receive messages (CVE-2026-113961), and a user added to a group could access messages sent before they joined (CVE-2026-113960). The two were fixed through improved verification and by removing the vulnerable code.
The Bluetooth and AirPlay flaws involve bypassing rate limits on pairing-code attempts. Specifically: an attacker within Bluetooth range could bypass the pairing-code attempt rate limit (CVE-2026-113964); a malicious Bluetooth device could establish pairing without user interaction (CVE-2026-113965); and an attacker on the same network could bypass the AirPlay pairing-code attempt rate limit (CVE-2026-113969). The Bluetooth flaw could also corrupt process memory (CVE-2026-113970).
Other fixes include an App Intents authorization issue that could let an app access sensitive user data (CVE-2026-113963); an out-of-bounds write in brotli that could cause memory corruption (CVE-2026-111497); and an AirPlay logic issue (CVE-2026-113968). Apple's official security content page still lists iOS 27.2 as the latest iOS version and has not yet posted CVE advisories for 27.2.1.
macOS 27.2.1: closing the residual certificate trust risk in command-line tools
macOS 27.2.1 fixes the residual risk from the eMudhra certificate flaw. In October 2026, Apple released a macOS update that blocked the compromised certificates in Safari, Mail and apps using Apple frameworks, but command-line tools such as curl and git could still accept them, leaving developers and advanced users exposed.
After this update, macOS command-line tools will no longer trust the affected eMudhra root certificate. That means network requests, code pulls and software installs run through the terminal will be subject to stricter validation of website and server identities, reducing the chance an attacker can forge a certificate for a trusted site.
The flaw stems from serious defects in some certificates issued by certificate authority eMudhra. A Mozilla investigation found that the private keys used in the certificates had values below 256 bits, making them easy to recover; attackers could use them to forge certificates that appear valid for any website, enabling man-in-the-middle attacks, data theft or redirects to malicious sites.
Apple had previously offered a manual workaround, instructing users to remove the affected root certificate from the /etc/ssl/cert.pem file. That guidance remains available for users who cannot upgrade immediately, but Apple explicitly recommends installing the latest update for fuller, automated protection.
Older OS versions receive fixes too
Besides macOS 27.2.1, Apple released macOS 26.7.3 and macOS 15.8.3 for devices running macOS 26 and macOS 15, extending the same fixes to more older systems. To install iOS 27.2.1, users go to Settings > General > Software Update and tap Download and Install when the prompt appears. Apple recommends backing up via iCloud or a computer beforehand and keeping the device charged and connected to Wi-Fi.
What to watch
As of publication, Apple's official security content page had not listed CVE advisories for iOS 27.2.1; details may come in a later update. Developers and advanced users should upgrade to macOS 27.2.1 or the corresponding older-version update as soon as possible to eliminate the certificate trust risk in command-line tools. Regular users should also watch for the iOS 27.2.1 rollout and install it promptly to fix the iMessage and Bluetooth vulnerabilities.