Lock screen pairing is supposed to be a convenience, never a doorway. This week’s Apple security drop treats it as a doorway anyway, adding a fix that stops a passing attacker from attaching a device to an AirPlay receiver without unlocking anything first.
A nine-platform release landed on November 9, covering iOS 27.2.1 and 18.7.12, the three macOS branches, watchOS 27.2.1 and visionOS 27.2.1, with ten corrections between them. Five came from Apple’s own engineers.
Bluetooth flaws that need no help from the owner
The radio stack drew the heaviest attention. One issue let a hostile Bluetooth gadget finish a pairing handshake with no action from the person holding the phone, while a related logic bug combined with it so a device within range could simply attach itself.
Older handsets were not excluded. The iOS 18.7.12 advisory covers iPhone XS, XS Max and XR plus the seventh-generation iPad, and there Apple documents the lock screen route.
The quiet fixes inside Messages
Two group chat corrections are the ones likely to matter most in daily use and least in headlines. One allowed a remote party to slide into a conversation and read what was shared inside it, an authorization check Apple replaced with stricter validation.
The second inverted the leak: a person newly pulled into a thread could scroll back through messages posted before their arrival. Neither needs a malicious app, so neither is caught by anything a user installs.
Update the watch as well
Because the pairing defects live in the radio layer, patching the phone while leaving a paired Watch or headset behind keeps part of the exposure live.
Owners of older hardware can check whether their model still receives updates through the security releases page rather than assuming a device that runs fine is still supported.
Source: SecurityWeek
