Apple Fixes an iMessage Flaw That Could Let an Outsider Join Your Group Chat: The Spec Sheet and an Update Checklist

Group chats have quietly become a business tool. Sales teams coordinate deals in them, managers share schedules and family-run firms make decisions in them. That is why Apple’s latest batch of security updates deserves attention: one of the fixes closes a hole that could have let an outsider slip into an iMessage group and read along.

The specifications below come from The Hacker News’ breakdown of Apple’s November 9 security notes.

The spec sheet

CVE-2026-113961: uninvited group member

Effect: a remote attacker could join a group chat and receive its messages.
Cause: an authorization issue, fixed with improved validation.

CVE-2026-113960: reading the back history

Effect: a person added to a group could access messages sent before they joined.

CVE-2026-111497: Brotli decoder

Effect: an out-of-bounds write in Google’s Brotli compression library that could let malicious input corrupt memory.
Exploitation: Apple’s notes do not mention attacks, but CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27 and notes that many products can include the component.

Bluetooth and AirPlay fixes (in all nine updates)

Two flaws could let a malicious Bluetooth device, or an attacker within Bluetooth range, pair with a device without any user action.
Two could let an attacker get around the limit on pairing-code attempts, one from Bluetooth range and one from the same network.
One could let an attacker in Bluetooth range corrupt process memory.

What Apple has not said

The notes leave several gaps. They do not say whether the iMessage flaws were exploited, what an attacker would need, whether group members would notice someone who joined this way, or whether every member must update to be protected. They do not say what a rogue paired Bluetooth device could do, and they offer no workaround for anyone who cannot update right away.

Where the fixes are, and where they are not

The security advisory for iOS and iPadOS 27.2.1 lists all three of the iMessage and Brotli fixes. Updates released the same day for the iPhone XS, XS Max and XR, the 7th-generation iPad and some Apple Watch models, including iOS 18.7.12 and watchOS 26.6.1, list other security fixes but not those three. Apple does not say whether devices on those versions are affected.

Update checklist

On every company-owned iPhone and iPad that supports it, install iOS or iPadOS 27.2.1, and update Macs and other Apple devices to their latest releases.
Ask staff using personal phones for work chats to update as well, since Apple has not said whether one updated device protects a whole group.
If you manage devices centrally, set a short deadline for these updates and report on which devices have not installed them.
List devices that cannot reach 27.2.1, such as the iPhone XS, XS Max and XR, and plan to keep sensitive conversations off them or replace them.
Turn Bluetooth off on devices that do not need it, especially in busy public places, and remove pairings nobody recognizes.
Review membership of work group chats and remove anyone who should no longer be in them.

What this means for your company

Phones are now where much of a small business actually talks, yet they are often the least managed devices in the company. Treat mobile updates with the same urgency as Windows patches, know which phones are too old to receive the full fix, and decide which conversations belong in a managed business messaging platform with proper membership controls rather than in personal chat apps.

Not sure which phones and tablets in your company are current, or even which ones touch company data? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.