Apple made iOS 27.2 available to the public on October 26, 2026, pushing more than 160 vulnerability patches to iPhones

Apple made iOS 27.2 available to the public on October 26, 2026, pushing more than 160 vulnerability patches to iPhones. iOS 27 arrived September 14, 2026, and iOS 27.2 entered beta September 16, 2026, shipping after roughly six weeks of testing.

Apple’s security notes identify 163 vulnerabilities fixed in iOS 27.2 and iPadOS 27.2, while Tenable counts 163 CVEs. iPadOS 27.2 also carries 163 fixes, and macOS Golden Gate 27.2 carries 263 fixes, with roughly 140 vulnerabilities shared across iOS and macOS.

A CoreMedia flaw lets a malicious app access an iPhone or Mac camera without asking the user for permission. Apple credits researcher Mustafa Calap for the bug, tracked as CVE-2026-86990. Apple says “an access issue was addressed with improved access restrictions.” On the Mac, TCC, which stands for Transparency, Consent, and Control, handles the camera permission prompt and blocks app access until the user approves.

Apple says the flaw aimed at the permission rather than the indicator, so the green recording light still activates, including the green dot in the iPhone status bar. Apple says it has no indication that the camera bug saw exploitation in the wild. Apple says the issue is not hardware-related because its post-2008 design connects the camera module and the green LED indicator on one circuit, keeping the indicator light tied to the camera hardware so it still activates. iPhone users can review camera permissions for apps through the Settings privacy menu.

Meta Product Security reported the CoreGraphics out-of-bounds write tracked as CVE-2026-86950. Apple says a report indicates the issue may have been exploited in an attack against specific individuals on versions before iOS 27, and the company “is aware of a report that this issue may have been exploited in an extremely sophisticated attack.” Apple fixed it in iOS 18.7.11 and first patched it in late September for macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, iOS 26.7.1, and iPadOS 26.7.1. iOS and macOS 27 are not affected.

iPhones from the iPhone 11 onward, including the iPhone Duo, can run iOS 27.2. Apple offers iOS 26.7.2 to users staying on iOS 26, while iOS 18.7.11 runs on iPhone XS, iPhone XS Max, and iPhone XR, which cannot run iOS 26 or iOS 27. Apple says no bug in iOS 27.2 or iOS 26.7.2 was actively exploited in the wild when the updates shipped.

In 2026, older iPhones have been frequent targets, among them the DarkSword spyware campaign.

iOS 27.2 addresses more than 30 WebKit issues, including flaws that allow maliciously crafted web pages to run code without permission. The iOS fix list includes 26 WebKit entries, with eight covering arbitrary code execution, while the kernel accounts for 15 entries.

Cisco Talos researchers found an App Store flaw that could let a remote attacker escape the WebContent sandbox. A flaw in Apple Intelligence on iPhone 15 Pro and later models could allow a remote attacker to access sensitive user data.

A flaw in AccessorySetupKit could let a malicious app use Bluetooth without requesting user consent, while a flaw in Hide My Email could reveal the user’s actual e-mail address. Four patches close Privacy preference bypasses in the Accounts framework, the Photos Storage framework, the kernel, and Spotlight. Apple also addressed a Maps issue that allowed select apps to view all applications installed on an iPhone.

Calif, the team behind an untethered iOS 27.0.1 jailbreak, receives credit on six CVEs. Researcher Stefan Esser says most jailbreak flaws receive fixes in iOS 27.2. Three iOS 27.2 fixes credit Anthropic Research, and four credit OpenAI.

Apple also shipped macOS Tahoe 26.7.2 with 213 vulnerability patches, macOS Sequoia 15.8.2 with 197, tvOS 27.2 with 72, and watchOS 27.2 with 62. visionOS 27.2 patches 125 vulnerabilities and Safari 27.2 patches 33. iOS and iPadOS 26.7.2 address 134 vulnerabilities, including many of the same security fixes found in iOS 27.2.

To install iOS 27.2, iPhone users go to Settings, General, Software Update, and Apple recommends backing up first and keeping the phone charged. With Automatic Updates enabled, future patches install without manual steps.

Apple says devices that remain unupdated could face attack once details are published. Postponing the update involves risk because information about patched bugs draws attention after publication. Apple said the update does not include patches for vulnerabilities previously used in targeted attacks.