iPhone Security Update: Fix the iMessage Group Chat Leak

You're in a family group chat with eight people. Somebody adds a cousin's new partner, and that person can now scroll back through months of messages that were never meant for them. Worse, a stranger joins the thread without anyone adding them at all.

Those are the two iMessage flaws Apple fixed on November 9 in its latest iPhone security update. The same release closes holes that let a nearby device pair with your iPhone over Bluetooth without you tapping anything. Apple shipped three versions at once, and the one you need depends on which iPhone you own and whether you moved to iOS 27. This guide shows which update is yours, what each one fixes, and how to stop this from happening again.

What the November iPhone Security Update Fixes

Apple publishes a page for every release that lists each flaw by component. For iOS 27.2.1, Apple's security notes list nine separate vulnerabilities. They fall into three groups.

The iMessage group chat bugs

The first, tracked as CVE-2026-113961, let a remote attacker join an iMessage group and receive its messages. Apple says it fixed this with improved validation. The second, CVE-2026-113960, let a user added to a group see messages sent before they joined. Apple's fix there was to remove the affected code entirely.

CyberInsider, which reported on the patches on November 10, notes that an anonymous researcher reported both bugs. It also reports that macOS Golden Gate 27.2.1 carries the same two fixes, so your Mac needs the update as well if it runs Messages.

The Bluetooth and AirPlay pairing bugs

Four entries deal with pairing. Two in a component called CoreUtils let a malicious Bluetooth device pair without any user interaction, and one of them also got around the limit on how many pairing codes an attacker could try. Similar rate limit bypasses sat in AirPlay (attacker in Bluetooth range) and in rapportd, the service that lets your Apple devices find each other (attacker on the same network).

A rate limit is what stops someone from guessing a pairing code over and over until one works. Remove it and a short code stops being a real barrier.

Memory and data bugs

The last group covers a Bluetooth flaw that could corrupt memory, a bug in the brotli compression library triggered by crafted input, and an App Intents issue that could let an app reach sensitive user data. Memory corruption bugs are the kind attackers chain together to run their own code, which is why they get patched even when no attack has been seen.

Which Update Should You Install?

This is where most people get confused. Since September 14, when Apple released iOS 27 alongside iOS 26.7, Apple has run two tracks for the same phones. You don't pick an update by phone model alone. You pick it by the version you already run.

• On iOS 27 (iPhone 11 or newer): install iOS 27.2.1. It lists nine fixes.
• Still on iOS 26 (iPhone 11 or newer): install iOS 26.7.3. It lists eight fixes, including both iMessage bugs and all four pairing bugs.
• iPhone XS, XS Max or XR: install iOS 18.7.12. These phones cannot run iOS 26 or 27.

To check, open Settings > General > About and look at the iOS Version line. Then go to Settings > General > Software Update. If you're on iOS 26, the screen offers 26.7.3 at the top and lists the upgrade to iOS 27 further down, so read the version number before you tap.

What staying on iOS 26 costs you

Plenty of people hold off on a major upgrade to avoid new bugs or redesigns. Apple supports that choice, but the two tracks are not identical. Compare the notes side by side and one entry is missing from iOS 26.7.3: the App Intents flaw (CVE-2026-113963) appears only in the iOS 27.2.1 list.

That's one bug out of nine this round. Still, it shows how the older track works. It gets the fixes Apple chooses to bring back, not every fix. If you plan to stay on iOS 26 for months, check each release's notes rather than assuming you're covered.

What the iPhone XS and XR update covers

The iOS 18.7.12 notes list six fixes. Four are the same pairing bugs, plus the Bluetooth memory flaw. The sixth is unique to this branch: a MediaRemote bug that let someone with the phone in hand pair a device with an AirPlay receiver from the lock screen.

The Messages entries don't appear on the iOS 18.7.12 list. Apple doesn't explain why, and absence from the list doesn't tell you whether those phones were affected. If you own one, install the update anyway: the Bluetooth fixes apply to you.

How Fast Apple Is Patching Now

Look at the dates on Apple's security releases page for the iOS 26 track alone. Version 26.7 arrived on September 14, 26.7.1 on September 28, 26.7.2 on October 26 and 26.7.3 on November 9. That's four security releases in 56 days, on top of the iOS 27 track running in parallel.

Macworld's Jason Cross, writing about the November 9 batch, put it plainly: "frequent operating system releases that fix dozens of security vulnerabilities are the new normal." He ties the pace to AI tools that make bugs easier both to find and to fix. The same pattern has shown up on PCs, where Windows security updates now fix more bugs each month than they used to.

For you, the practical effect is simple. A habit of updating "when I get around to it" now leaves you further behind than it did a few years ago.

A Worked Example: The Cost of Updating Once a Month

Say you check for updates on the first of every month. Here's how that played out on the iOS 26 track this autumn, using Apple's real release dates.

1. October 1: you install 26.7.1, released September 28. You're current.
2. October 26: Apple releases 26.7.2. You don't see it.
3. November 1: you install 26.7.2. You were six days behind.
4. November 9: Apple releases 26.7.3 and publishes descriptions of all eight bugs.
5. December 1: you install 26.7.3. You spent 22 days running a version whose flaws Apple had already described in public.

Now compare automatic installs. Apple says that with Automatically Install on, your iPhone "downloads and installs the update overnight while charging and connected to Wi-Fi." Plug in on the night of November 9 and the gap shrinks from 22 days to roughly one.

None of the November 9 bugs is marked as exploited, so this is not an emergency. But once a fix is public, anyone can compare the old and new code to work out exactly what changed. Release day is when the clock starts, not when the risk ends.

Steps to Take Today

The fix takes about ten minutes. Do these in order.

1. Back up first. Settings > [your name] > iCloud > iCloud Backup > Back Up Now. Plug into power and stay on Wi-Fi.
2. Install the right version from Settings > General > Software Update, using the list above.
3. Turn on automatic installs. In the same menu tap Automatic Updates and switch on Automatically Install. If you'd rather choose the moment, turn on Automatically Download at least.
4. Update every Apple device you use Messages on, including your Mac and iPad. Messages syncs across them.
5. Ask the people in your group chats to update. Apple hasn't said whether one unpatched phone in a thread is enough to expose it, so the cautious move is to get everyone current.

Quick habits for Bluetooth

Turning Bluetooth off isn't practical if you use AirPods or a watch. A better habit is to check Settings > Bluetooth now and then and remove anything listed under My Devices that you don't recognise. If you'd like a broader checklist of iPhone safety habits, our guide to staying safe after the DarkSword iPhone hack covers Lockdown Mode and other protections in more detail.

If You Also Own an Android Phone

Households rarely run one platform. The Bluetooth problems Apple fixed are an Apple code issue, so they don't carry over to Android. But the lesson does: a phone that has stopped getting patches can't receive fixes like these at all. If you have an older Android in the house, check whether your Android phone still gets security updates before you assume it's protected.

On iPhone, the dividing line this round is clear. iPhone 11 and later get the full iMessage fixes on either track. The XS and XR get their own, shorter list. Older models do not appear on any of the three lists.

Frequently Asked Questions

Is iOS 26.7.3 safe to install if I don't want iOS 27?

Yes. Apple built iOS 26.7.3 for people who stay on iOS 26, and it includes both iMessage fixes and all four Bluetooth pairing fixes. Installing it does not move you to iOS 27. Just read the version number on the Software Update screen before you tap, because the iOS 27 upgrade is offered on the same page.

Were the iMessage group chat bugs used in real attacks?

Apple did not mark either iMessage flaw, or any other November 9 fix, as possibly exploited. Apple's notes carry a flag when it is aware of reports that a bug may have been exploited, and none of these has one. That makes this a routine but important update rather than an emergency patch.

Can someone pair with my iPhone over Bluetooth without me knowing?

Before this update, Apple's notes say a malicious Bluetooth device could pair without user interaction, but the attacker had to be within Bluetooth range. After you install iOS 27.2.1, 26.7.3 or 18.7.12, those specific flaws are closed. Checking your Bluetooth device list for unknown entries is a sensible extra step.

Does my Mac need the update too?

If you use Messages on a Mac, yes. CyberInsider reports that macOS Golden Gate 27.2.1 fixes the same two iMessage issues, and Apple also released updates for macOS Tahoe and Sequoia on the same day. Update every device signed in to your Apple Account.

How do I turn on automatic iPhone updates?

Go to Settings > General > Software Update > Automatic Updates and switch on Automatically Install. Your iPhone will then install updates overnight while it charges on Wi-Fi. If you prefer to approve each one, switch on Automatically Download instead so the file is ready when you are.

Update Tonight, Then Stop Thinking About It

The November 9 release fixes nine flaws on iOS 27, eight on iOS 26 and six on the iPhone XS and XR. The two that matter most for daily life are the group chat leaks, and both are closed on any iPhone 11 or newer that installs the right version.

Pick your version from the list, back up, install, and switch on Automatically Install before bed. At the pace Apple now ships fixes, the setting does more for your security than any single update. Then send one message to your busiest group chat: "Update your phones."