iOS 27.2.1 Is Out: Update Your iPhone Now to Fix iMessage and Bluetooth Security Flaws

November 10, 2026

iOS 27.2.1 is now available, and it is one iPhone update you should not leave sitting in Settings. Apple released the update on Monday 9 November 2026 to fix a set of security flaws, including an iMessage bug that could let a remote attacker join a group chat and read its messages without being invited. The update is free for every iPhone 11 or later running iOS 27, and it is rolling out to UK users now.

Coming just two weeks after iOS 27.2, which arrived with new features for the iPhone Duo and more than 130 security fixes, iOS 27.2.1 adds no new features of its own. Instead, it closes a handful of holes in Messages, Bluetooth and AirPlay that are serious enough for Apple to push out a dedicated release, alongside matching updates for older iPhones, iPads, Macs, Apple Watch and Vision Pro.

What iOS 27.2.1 fixes

Apple’s release notes simply say the update “provides bug fixes and security updates for your iPhone”, but the company’s security notes give much more detail. The most eye-catching fixes involve iMessage group chats, while the rest focus on wireless connections:

iMessage group chats: a remote attacker may have been able to join an iMessage group chat and receive its messages. Apple says it fixed this authorisation issue with improved validation.
iMessage message history: a person added to an iMessage group may have been able to see messages sent before they joined. Apple fixed this by removing the vulnerable code.
Bluetooth pairing: a malicious Bluetooth device may have been able to pair with an iPhone without any user interaction, and a separate flaw could let an attacker in Bluetooth range bypass the limit on pairing code attempts.
Bluetooth memory: a use-after-free bug could allow an attacker in Bluetooth range to corrupt process memory.
AirPlay: attackers in Bluetooth range, or on the same network, may have been able to get around the limit on AirPlay pairing code attempts.
App Intents: an authorisation issue could let an app access sensitive user data.
Brotli: an out-of-bounds write in this data compression library could lead to memory corruption when processing maliciously crafted input.

Apple credits its own teams with finding four of the flaws, covering AirPlay, Bluetooth, CoreUtils and rapportd (the background service behind Continuity features such as Handoff). The others, including both iMessage bugs, are credited to outside researchers.

Why the iMessage flaw matters

Group chats are where many of us share everything from family plans to work updates, and iMessage is designed so that new members cannot scroll back through what was said before they arrived. That is a useful privacy feature, and it is one that sets iMessage apart from some rival messaging apps.

The bug fixed in iOS 27.2.1 broke that promise. Someone added to a group may have been able to read earlier messages, and you would have had no obvious way of knowing. Combined with the separate flaw that could let an uninvited attacker join a chat outright, it is easy to see why this update should not wait.

There is also a group element to the risk. Because the iMessage fixes sit on each person’s device, a group chat is only fully protected once everyone in it has updated, so it is worth nudging friends and family to install the update too.

Has anyone been attacked?

Apple has not said that any of these vulnerabilities have been exploited in the wild, which is good news. However, now that details of each flaw are public, iPhones that have not been updated could become a more attractive target. That is the main reason to install security releases like this one as soon as they appear, rather than waiting for the next big feature update.

Updates for older iPhones, iPads and Macs

If your iPhone is not on iOS 27, you are not left out. Apple has also released iOS 26.7.3 and iOS 18.7.12, with iPadOS 27.2.1, 26.7.3 and 18.7.12 for iPad. iOS 26.7.3 includes the two iMessage fixes, while iOS 18.7.12 carries many of the same Bluetooth and AirPlay patches.

Mac owners get macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3. The Mac update also addresses the eMudhra certificate vulnerability, adding protections for command-line tools. Apple Watch users can install watchOS 27.2.1 or watchOS 26.6.1, and Vision Pro owners get visionOS 27.2.1.

How to install iOS 27.2.1 in the UK

The update is free and is rolling out to all eligible iPhones in the UK. To install it, open the Settings app, tap General, then Software Update, and follow the prompts. It is a good idea to connect to Wi-Fi, plug your phone into a charger and make sure you have a recent iCloud or computer backup before you start.

What comes next

iOS 27.2.1 arrives while Apple is already testing iOS 27.3 in beta. That bigger release is expected to bring new features, but for anyone sticking with the public version of iOS 27 for now, iOS 27.2.1 is the update to install today. You can read the full list of fixes in Apple’s security notes for iOS 27.2.1 and iPadOS 27.2.1.