Apple released updates yesterday for two iMessage flaws, and the more serious one is a simple proposition. An attacker could join a group chat they were never invited to, and receive the messages in it.

The flaw is tracked as CVE-2026-113961. Apple describes it as an authorization issue, fixed through improved validation.

A second flaw, CVE-2026-113960, could let someone who was added to a group access messages sent before they joined. That is a smaller blast radius, but it is still a history leak in a feature people use for exactly the conversations they do not want leaked.

The Device Gap Nobody Has Explained

Here is where the update situation gets uncomfortable.

The fixes ship in iOS and iPadOS 27.2.1. The security advisory for that release describes all three flaws covered in this article, including the Brotli issue we will get to.

But Apple also released separate updates yesterday for older hardware, including the iPhone XS, XS Max, XR, the iPad (7th generation), and some Apple Watch models.

Those updates do not list either iMessage fix.

Apple does not say whether devices running those versions are affected by the three flaws. It also offers no workaround for anyone who cannot update right away.

That silence is the actual problem. If you are holding an iPhone XS because it still works, you cannot tell from Apple's notes whether you are exposed or not.

What Apple Has Not Said

The notes leave several operational questions unanswered, and each one matters for anyone trying to assess risk.

• Whether either iMessage flaw has been exploited
• What an attacker would need in order to exploit it
• Whether group members would see someone who joined this way
• Whether every member of a group has to update to be protected

That last one is the most consequential for practical defense. If protection requires every participant to patch, then group chats remain exposed for as long as any single member is running an unpatched build.

Apple has not said.

The Brotli Flaw Bundled Into the Same Release

The updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library, tracked as CVE-2026-111497.

This is the same out-of-bounds write in Brotli's decoder that has been rolling through the ecosystem for weeks. Malicious input can corrupt memory, and the exposure depends on whether the application decodes Brotli data an attacker controls.

CISA added it to its Known Exploited Vulnerabilities catalog on October 27. The catalog entry names Google's Brotli as the affected product and notes that different products can use the component.

Apple's notes do not mention any attacks using the Brotli flaw specifically in Apple's implementation. But CISA's KEV listing means exploitation has been confirmed somewhere in the ecosystem, and the patch should not be treated as optional.

The Bluetooth and AirPlay Flaws

All nine updates released yesterday fix Bluetooth and AirPlay issues, and two of them are worth reading closely.

Two flaws could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a device without user interaction. The notes do not say what a paired device could then do with that access.

Two others could let an attacker bypass the limit on pairing code attempts. One works from Bluetooth range, the other from the same network.

Another could let an attacker within Bluetooth range corrupt process memory.

The common thread is proximity. These are not remote-internet flaws. They are flaws that require an attacker to be physically nearby, which is a lower-severity profile than the iMessage bug but not a comfortable one for anyone carrying a phone through a crowd.

What Users Should Actually Do

• Update to iOS or iPadOS 27.2.1 if your device supports it. That is the only release that names the iMessage fixes.
• Check whether your device is on 18.7.12 and ask Apple. If you are on the older branch, the notes do not tell you whether you are exposed. Support is the only path to an answer.
• Treat group chats as potentially exposed until everyone patches. Apple has not said whether protection requires all participants to update. Assume it might.
• Do not share sensitive information in group iMessages in the interim, especially on devices that cannot reach 27.2.1.
• Update the watch too. watchOS 26.6.1 does not list the iMessage fixes, but it does carry other security updates, and a paired watch can receive messages.
• Patch for Brotli regardless. CISA has confirmed exploitation in the broader ecosystem. The Apple-specific exposure is unclear, but the update is available and the flaw is real.
• Watch Bluetooth exposure in public spaces until patched. Turn Bluetooth off when you are not using it, particularly in crowded locations.

Why the Disclosure Gaps Matter More Than Usual

Apple's standard practice is to publish a security advisory naming the flaw, the impact, and the fix. It often withholds exploitation details for a period to give users time to update.

That is a reasonable policy. But this release leaves gaps that go beyond the usual withholding.

Whether an entire device class is affected is not a detail that needs protecting. Neither is whether a group is protected only when every member has updated. Those are operational questions, and users cannot make informed decisions without answers.

For now, the practical answer is the same as it usually is. Update what you can, ask about what you cannot, and treat the rest as exposed.

FAQ

What is CVE-2026-113961?

It is an authorization issue in iMessage that Apple says could let a remote attacker join a group chat and receive its messages. It is fixed through improved validation in the relevant updates.

What is CVE-2026-113960?

It is a separate iMessage flaw that could let someone who was added to a group access messages sent before they joined.

Which update fixes them?

iOS and iPadOS 27.2.1 lists all three flaws, including the Brotli issue. The security advisory for that release is the one that describes the fixes.

Does iOS 18.7.12 include the iMessage fix?

Apple's notes for iOS 18.7.12 list other security fixes but not the iMessage or Brotli fixes. Apple does not say whether devices on that version are affected.

Which devices are on the older branch?

The iPhone XS, XS Max, XR, the iPad (7th generation), and some Apple Watch models received updates yesterday that do not list the fixes.

Does every group member need to update?

Apple has not said. That is one of several operational questions the notes leave unanswered, along with whether the flaw has been exploited and whether group members would see someone who joined this way.

Is there a workaround?

Apple's notes offer no workaround for anyone who cannot update right away.

What is the Brotli flaw in the same release?

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. CISA added it to its Known Exploited Vulnerabilities catalog on October 27. Apple's notes do not mention attacks using it against Apple's implementation.

What are the Bluetooth and AirPlay flaws?

All nine updates fix Bluetooth and AirPlay issues. Two could allow a malicious Bluetooth device or an attacker in range to pair with a device without user interaction. Two others could bypass pairing code attempt limits. Another could corrupt process memory from Bluetooth range.

Should I stop using group iMessage?

That is a judgment call. Until Apple clarifies whether all members must update, treating group chats as potentially exposed on unpatched devices is reasonable. Moving sensitive conversations to another channel is the cautious choice.

Source: The Hacker News