Apple released iOS 27.2.1 and macOS Golden Gate 27.2.1

Apple released iOS 27.2.1, iPadOS 27.2.1, and macOS Golden Gate 27.2.1 on November 9. Both security notes are dated that day. The iPhone note lists fixes for AirPlay, Bluetooth, and an app-data bug. The Mac note lists those areas and two iMessage group-chat bugs. Apple does not say any of these bugs were used in attacks.

The Mac note describes two separate Messages bugs. Apple says a remote attacker may have been able to join an iMessage group and read its messages. It lists that as CVE-2026-113961 and credits an unnamed researcher. A second bug, CVE-2026-113960, may have let someone added to a group read messages sent before they joined. Apple also credits an unnamed researcher for that one.

AirPlay and Bluetooth fixes appear on both notes. Apple says someone within Bluetooth range may have been able to get around the limit on AirPlay pairing-code attempts. That is CVE-2026-113968. A separate Bluetooth bug, CVE-2026-113970, may have let someone in range corrupt process memory. On the Mac, Apple also lists CVE-2026-113964, which may have let someone in Bluetooth range pair without a person approving it. Apple credits itself for the first two and an unnamed researcher for the third.

The iPhone note covers iPhone 11 and later, plus listed iPad models. It says an app may have been able to read sensitive user data, listed as CVE-2026-113963, and credits László Várady. It also says a malicious Bluetooth device may have been able to pair without a person approving it, listed as CVE-2026-113965. The notes do not give a download size. They do not say the older iOS 27.2 build is still the latest on Apple's releases index.