Apple iMessage e Bluetooth · Exploitation reported

[Single source] Apple patches iMessage flaws exposing group chats

Nov 10, 2026 · 1 min read

Apple fixed two iMessage flaws: one let a remote attacker join a group chat uninvited and read its messages, and the other let newly added members read messages sent before they joined. The same update closes Bluetooth holes that allowed a nearby malicious device to pair with an iPhone without the owner tapping anything. Update to iOS 27.2.1, macOS 27.2.1 or iOS 26.7.3.

By HIFY Radar newsroom Updated 11/10/2026 04:35 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation reportedPatched

In 30 seconds

Observed

Apple has shipped fixes for two iMessage flaws that went straight at group chats. One could let a remote attacker join a group chat uninvited and receive its messages. The other let anyone newly added to a group read messages sent before they joined. The same update also closes Bluetooth holes that could let a malicious device sitting nearby pair with an iPhone without the owner tapping anything.

Observed

The fix is already available. Install iOS 27.2.1 or macOS 27.2.1, or iOS 26.7.3 if your iPhone is still on the iOS 26 track.

What happened

Observed

The decisive move is the patch itself. Apple fixed the two iMessage flaws, cataloged as CVE-2026-113961 and CVE-2026-113960, and rolled the fixes into iOS 27.2.1 and macOS 27.2.1. iPhones that have not moved to iOS 27 get the same protections through iOS 26.7.3, a backport, meaning the fix was carried over to the older software branch.

Observed

Here is what each flaw did, as Apple's release describes it. The first bug meant an attacker could join a group chat without an invitation and then receive the messages flowing through it. The second meant that when someone was added to a group, they could read messages sent before they ever joined. The same update also shut Bluetooth holes that allowed a malicious device close to an iPhone to pair with it with no tap, no prompt, nothing from the owner.

Observed

Apple credits an anonymous researcher with finding both iMessage bugs, and the company gives no indication that either one was exploited before the fix landed.

Why it matters

Inferred

Group chats carry an assumption of a closed room. People share plans, photos, and personal talk believing only members can see it. A flaw that lets an uninvited listener receive the messages breaks that assumption silently, and there would likely be no visible sign that anyone extra is in the conversation.

Inferred

The second bug is the quieter problem. Even in a carefully managed group, adding one new member could have handed them the entire history from before they joined, material that existing members never agreed to share with that person.

Inferred

The Bluetooth issue deserves equal attention because it removes the human checkpoint. Pairing normally requires the owner to confirm. A nearby malicious device pairing without any tap means the attack needs physical proximity but no interaction from the person holding the phone.

What to do

Observed

Update now. Current iPhones take iOS 27.2.1, Macs take macOS 27.2.1, and iPhones still running iOS 26 take iOS 26.7.3. All three carry the fixes for the iMessage flaws and the Bluetooth pairing holes.

Inferred

Patch every device you use iMessage on, not just the phone. The same conversation syncs across your Apple devices, and a Mac or iPhone left on an old version keeps the exposure alive even after your other hardware is current.

Confirmed and still uncertain

Observed

What is established: Apple patched both iMessage flaws, tracked them as CVE-2026-113961 and CVE-2026-113960, shipped fixes in iOS 27.2.1, macOS 27.2.1, and iOS 26.7.3, and credited an anonymous researcher for both bugs.

Observed

What is not known: whether either iMessage bug was exploited in the wild. Apple does not say, per the available report. The technical mechanics of the uninvited join are also not documented in this batch, so there is no public detail on how the trick actually worked.

Observed

A few more open threads. The report lists both CVE numbers together without saying which number maps to which bug. Who found the Bluetooth flaws, and whether that issue carries its own identifier, is also left unsaid.

What people are saying

Observed

The only voice captured in this batch is IntCyberDigest, a cybersecurity digest account on X, which opened its post with a double exclamation mark and summarized the situation in one line: "Apple patched an iMessage bug that let a remote attacker join a group chat uninvited and receive its messages."

Observed

The account leads with the uninvited join as the headline, folds the pre-join history flaw into the same warning, and closes with the Bluetooth pairing issue and the fix versions. Beyond that framing, this batch contains no vendor statement, researcher comment, or user reaction.

Evolution

Observed

The public trail in this evidence starts at the end of the story: the finished patch. The advisory details, the two CVE assignments, the researcher credit, and the digest's amplification on November 10, 2026 are all we can see. No earlier proof of concept, researcher writeup, or disclosure back-and-forth appears in the batch.

Inferred

Reading between the lines, the anonymous researcher credit suggests the iMessage bugs reached Apple through private disclosure rather than a public find. That path is plausible but not documented here, so treat it as an inference rather than a reported fact.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

The two iMessage flaws are cataloged as CVE-2026-113961 and CVE-2026-113960. A CVE is simply the industry's catalog number for a known security hole, which lets vendors, researchers, and users refer to the same bug unambiguously. The report does not pair either number with a specific flaw.

Observed

Mechanically, the first flaw allowed a remote attacker to join a group chat uninvited and receive its messages. The second exposed history: a member added later could read messages sent before they joined. Separately, the Bluetooth holes let a malicious device in physical proximity pair with an iPhone with zero interaction from the owner.

Observed

On the delivery side, the fixes ship in iOS 27.2.1 and macOS 27.2.1, and Apple also pushed iOS 26.7.3 so iPhones still running the iOS 26 branch receive the same protections without being forced onto the newer major version.

Sources and evidence

Observed

This entire brief rests on one item: an X post by IntCyberDigest (https://x.com/IntCyberDigest/status/2120057117776265352), timestamped November 10, 2026, which summarizes Apple's patch release and includes an image card credited to the account. Every claim above traces to that single secondary source relaying Apple's advisory.

Inferred

Read it with matching confidence. Version numbers and CVE identifiers are reported accurately by the digest but have not been checked against Apple's own advisory pages in this batch, and no researcher writeup or exploit reporting exists here to cross-check. Stronger sourcing would mean the vendor advisory itself plus independent confirmation of the flaw behavior.