Apple shipped a broad set of security updates on November 9 that touches nearly every device it sells, and the most serious fixes sit in the Bluetooth stack where an attacker needs no interaction at all.
Eight distinct flaws landed across iOS 27.2.1, iPadOS 27.2.1, iOS 26.7.3, iOS 18.7.12, the three supported macOS branches, watchOS 27.2.1 and visionOS 27.2.1.
Two Bluetooth bugs hand over pairing
In CoreUtils, CVE-2026-113965 let a malicious Bluetooth device establish a pairing without any user action. A companion logic flaw, CVE-2026-113964, married that missing rate limit to a second weakness and let a nearby attacker pair outright. Apple credited an anonymous researcher for the second and its own engineers for the first.
The Bluetooth module carries a use-after-free, CVE-2026-113970, that corrupts process memory from radio range. A brotli out-of-bounds write, CVE-2026-111497, turns crafted input into memory corruption, and CVE-2026-113963 is an authorization gap exposing user data to an installed app.
Messages groups stayed open to strangers
The iMessage fixes are the ones most likely to matter quietly. CVE-2026-113961 let a remote party join a group conversation and read everything sent inside it, an authorization failure Apple corrected with better validation. CVE-2026-113960 went the other way: someone added to a thread could pull messages posted before they arrived. Apple removed the vulnerable code rather than patching around it.
AirPlay throttling collapses on two fronts. CVE-2026-113968 covers device-to-device attempts and CVE-2026-113969 covers rapportd on a shared network, so guess faster and the limit stops mattering. Older hardware gets an extra fix in 18.7.12: CVE-2026-113971 allowed AirPlay receiver pairing straight from the lock screen.
None of the eight carries a report of active exploitation. Install from Settings, or run softwareupdate, before the week is out.
