Thursday, 29 October 2026

Apple patches 329 flaws in iOS 27.2 and other updates

Apple's 27.2 releases on 26 October fix at least 329 unique security flaws, including one that may have been used in targeted attacks.

Key points

  • Apple fixed at least 329 unique vulnerabilities in its 27.2 releases on 26 October.
  • Updates cover iPhone, iPad, Mac, Apple Watch, Apple TV and Vision Pro.
  • One CoreGraphics flaw may have been used in targeted attacks on older iOS versions.

On 26 October Apple shipped version 27.2 of iOS, iPadOS and macOS, along with matching releases for its other platforms. According to 9to5Mac’s reading of Apple’s security notes, the releases address at least 329 unique vulnerabilities, with 1,265 CVE listings once overlaps between operating systems are counted.

The figures may change as Apple revises its advisories, so treat them as a minimum for now.

Why it matters

With hundreds of flaws fixed, these updates are worth installing promptly. Apple is also shipping fixes for older software lines, which means even phones that cannot run iOS 27 get protection. If you use an iPhone or iPad, updating today is the simplest way to close these holes.

Which updates are out

Update Who gets it
iOS and iPadOS 27.2 iPhone 11 and newer, plus compatible iPad Pro, iPad Air, iPad and iPad mini models
iOS and iPadOS 26.7.2 Devices still on the 26 release
iOS and iPadOS 18.7.11 iPhone XS, XS Max, XR and iPad 7th generation, among others
watchOS, tvOS and visionOS 27.2 Apple Watch, Apple TV and Apple Vision Pro

Mac users get macOS 27.2, 26.7.2 or 15.8.2 depending on their version, along with Safari 27.2. The iOS 27.2 security notes carry Apple’s device lists in full. The same release also brings the beta of Siri AI to more languages, according to Apple’s announcement.

Notable fixes

One CoreMedia flaw (CVE-2026-86990) might allow a rogue app to reach the camera without permission. Another, in Apple Intelligence (CVE-2026-86987), might expose sensitive user data to a remote attacker; Apple limits that feature to the iPhone 15 Pro and newer.

Several WebKit bugs could allow arbitrary code to run if a device loads specially crafted web content. The most serious is a CoreGraphics bug (CVE-2026-86950), where processing a malicious file could lead to arbitrary code execution. Apple’s notes for iOS 18.7.11 say Apple has heard a report that this bug may have been used in a highly sophisticated attack aimed at specific individuals, on iOS versions older than iOS 27. Apple did not report that other fixes in this batch were exploited.

How to update

Open Settings, tap General, then Software Update, and install the newest version offered for your phone. Keep the phone on Wi-Fi and plugged in, since large updates can take a while and use a lot of data.

What happens next

Apple may add more details to its security pages in the coming days. Users on iPhone XS, XS Max and XR should look for iOS 18.7.11, as those phones cannot move to the newest release.

TPRO Team

The Tech Prolonged newsroom desk. Stories under this byline cover AI, the web and general tech, and are reviewed by our editors before publishing.