Update Your IPhone to Prevent Strangers From Viewing Your IMessages.

Posted on by

Has this ever happened to you? You add a new member to an iMessage group chat and wonder, “Do they see messages from before they were added?” The answer should be “no.” By design, new members of an iMessage group chat only see messages received after they were added. When they join, it’s essentially a blank slate, as if you’d just created the group. At least, that’s the way it’s designed.

There are currently two security vulnerabilities discovered in iMessage.

It turns out there’s a bug in iMessage that can allow new members of a group chat to see messages sent before they’ve been added. This isn’t just a problem for iPhone users who gossip about people before inviting them to a group chat. It means iMessage and Apple’s platforms in general aren’t working as they should. You don’t have to gossip behind people’s backs to avoid new members seeing existing chats. Perhaps you’re planning a surprise party for someone and adding them to the group when everyone else is already in on the plan; perhaps the messages in the chat aren’t relevant to the current group, and the person joining the group simply doesn’t need access to them.

That’s not all: there’s another security vulnerability that could allow remote hackers to join an iMessage group and receive new messages. You could add a new user to a group chat and inadvertently invite them to read all existing messages, simultaneously exposing yourself to an attacker who could then intercept all future messages. That’s not good.

You may also like

iOS 27.2.1 fixes this bug, along with eight others.

Fortunately, there’s now a solution to these issues. On Monday, Apple fixed (and identified) these bugs, along with seven other security vulnerabilities, by releasing a series of software updates for iPhone, iPad, Mac, Apple Watch, and Vision Pro. Not all updates include fixes for these two iMessage vulnerabilities—in particular, some updates for older Apple devices. But the rest, including iOS 27.2.1, macOS 27.2.1, macOS 26.7.3, macOS 15.8.3, watchOS 27.2.1, and visionOS 27.2.1, contain fixes for iMessage.

Each update comes with its own list of fixes, but in this article, I’ll cover the nine fixes in iOS 27.2.1. You’ll find two iMessage bug fixes, along with seven other fixes, listed below:

What do you think at the moment?

  • AirPlay : Impact: An attacker within Bluetooth range can bypass the pairing attempt limitation using a code. Description: Addressed a logic issue through improved state management. CVE-2026-113968: Apple

  • Application Intents : Impact: An application can access sensitive user data. Description: An authorization issue was addressed through improved state management. CVE-2026-113963: Laszlo Varadi

  • Bluetooth : Impact: An attacker within Bluetooth range may be able to corrupt process memory. Description: A use-after-free issue is addressed through improved memory management. CVE-2026-113970: Apple

  • brotli : Impact: Processing specially crafted malicious input may lead to memory corruption. Description: An out-of-bounds write issue was addressed through improved input validation. CVE-2026-111497

  • CoreUtils : Impact: A malicious Bluetooth device could establish pairing without user interaction. Description: This issue was addressed through improved validation. CVE-2026-113965: Apple

  • CoreUtils : Impact: An attacker within Bluetooth range can bypass the pairing attempt limitation and pair with the device without user intervention. Description: Addressed a logic issue through improved state management. CVE-2026-113964: Anonymous researcher

  • Messages : Impact: A remote attacker can join an iMessage group chat and receive its messages. Description: Addressed an authorization issue through improved validation. CVE-2026-113961: Anonymous researcher

  • Messages : Impact: A user added to an iMessage group can access messages sent before they joined. Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: Anonymous researcher

  • Rapportd : Impact: An attacker on the same network could bypass the AirPlay pairing code entry limit. Description: Addressed a logic issue with improved state management. CVE-2026-113969: Apple

A full list of fixes included in other security updates can be found onApple’s official security updates website .

How to Fix These iMessage Vulnerabilities

To install the latest security updates from Apple, simply update your device as usual. On iPhone, iPad, Apple Watch, and Vision Pro, go to Settings > General > Software Update ; on Mac, go to System Preferences > General > Software Update . Follow the on-screen instructions to download and install the latest software for your device.

More…

Apple

Leave a Reply