Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities Swati KhandelwalNov 10, 2026Vulnerability / Mobile Security An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either fix. The company's notes also do not say whether either flaw has been exploited, what an attacker would need, whether group members would see someone who joined this way, or whether every member must update to be protected. The updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library. The notes do not mention any attacks using that flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27. The flaw that could let a remote attacker join a group chat is tracked as CVE-2026-113961. It is an authorization issue that the updates fix through improved validation. The flaw involving earlier messages is CVE-2026-113960. Each operating system version got its own update. The security advisory for iOS and iPadOS 27.2.1 describes all three flaws. The security releases list links to the notes for every update. The iOS 18.7.12 notes and the watchOS 26.6.1 notes list other security fixes but not the iMessage or Brotli fixes. The company does not say whether devices on those versions are affected by the three flaws. Its notes also offer no workaround for anyone who cannot update right away. The Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory. CISA's catalog entry for the Brotli decoder flaw names Google's Brotli as the affected product and says different products could use the component. All nine updates fix Bluetooth and AirPlay flaws. Two could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a device without user interaction. The notes do not say what a paired device could then do. Two others could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network. Another could let an attacker in Bluetooth range corrupt process memory. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Apple, mobile security, Vulnerability, Web Security The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing The Flood is Coming And The Pipes Were Already Full CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk