Apple has released iOS 27.2 and iPadOS 27.2, and this is one of the biggest security updates of the year. It fixes 163 vulnerabilities across WebKit, the kernel, Apple Intelligence and Mail. At the same time, Apple has pushed an emergency patch for older iPhones against a CoreGraphics flaw that attackers have already used. Here is what the update fixes, what is new and whether you should install it today.
iOS 27.2 Security Fixes: What Was at Risk
According to Apple’s security notes, as summarized by security news sites and MacRumors, iOS 27.2 patches 163 CVEs. The most important ones are:
- WebKit (Safari engine): 34 entries, including eight bugs where “processing maliciously crafted web content may lead to arbitrary code execution”. In simple words, a booby-trapped web page could run code on your iPhone. Two more bugs could let an attacker escape the Safari sandbox.
- Kernel: about 15 bugs, several of them use-after-free flaws that attackers often chain with WebKit bugs.
- Apple Intelligence (CVE-2026-86987): a remote attacker could access sensitive user data on iPhone 15 Pro and later.
- Mail and Hide My Email (CVE-2026-112500): your real email address could leak when using Hide My Email.
- CoreMedia (CVE-2026-86990): a malicious app could access the camera without permission.
- File readers such as ImageIO, CoreGraphics, CoreAudio and FontParser, which handle images, fonts and audio files.
Six of the fixes credit Calif, the team that broke the security of the new iPhone Duo on launch day. Calif researchers said iOS 27.2 fixes “most” of the vulnerabilities used in that jailbreak. Interestingly, researchers from two AI labs are also credited on several fixes, a sign that AI tools are now finding real iOS bugs.
Exploited Zero-Day Fix for Older iPhones (CVE-2026-86950)
Separately, Apple has released a fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics, the framework that draws images and text. Opening a malicious file could lead to code execution. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals”, and Meta Product Security reported it.
Newer devices received this fix in September. This week’s update for older models, reported by BleepingComputer, covers older devices that cannot run the latest iOS:
- iPhone XS, iPhone XS Max and iPhone XR
- iPad 7th generation, iPad 9th generation and later
- iPad Air 4th generation and later, iPad mini 6th generation and later
The attacks were highly targeted, so most people were not at risk. Still, if you or a family member uses one of these older iPhones, install the update.
New Features in iOS 27.2
- Multi-view on iPhone: watch up to four live Apple TV sports streams at once, for example MLS matches.
- Voice assistant improvements: it can recall past conversations and supports new languages.
- Dual Capture in group FaceTime calls.
- Find My: second- and third-generation Apple TV remotes now appear in the app.
Which Devices Get iOS 27.2?
| Update | Devices |
|---|---|
| iOS 27.2 / iPadOS 27.2 | iPhone 11 and later; iPad Pro 12.9-inch (4th gen) and 11-inch (2nd gen) and later; iPad Air (4th gen) and later; iPad (9th gen) and later; iPad mini (6th gen) and later |
| iOS 26.7.2 / iPadOS 26.7.2 | Devices that stay on iOS 26, with many of the same security fixes |
| CoreGraphics fix for older models | iPhone XS, XS Max, XR and older supported iPads |
Apple also released macOS 27.2, watchOS 27.2, tvOS 27.2 and visionOS 27.2 the same day, so update your other Apple devices too.
How to Update to iOS 27.2
- Back up your iPhone to iCloud or your computer.
- Connect to Wi-Fi and plug in your charger.
- Open Settings → General → Software Update.
- Tap Update Now and enter your password.
- Wait for the install to finish. It usually takes 15 to 30 minutes.
Turn on Automatic Updates in the same menu so future security fixes install overnight without you having to remember.
More tech news this week: M6 MacBook Pro: price, specs and release date.
Frequently Asked Questions
Should I update to iOS 27.2?
Yes. iOS 27.2 fixes 163 security flaws, including eight WebKit bugs that could let a malicious website run code on your iPhone, and most of the bugs used in the public iPhone Duo jailbreak. Apple says none of them are known to be exploited, but now that the fixes are public, iPhones without the update are an easier target.
Which iPhones can get iOS 27.2?
iOS 27.2 supports iPhone 11 and later. If your iPhone cannot run iOS 27, or you do not want to upgrade yet, iOS 26.7.2 includes many of the same security fixes.
What is new in iOS 27.2?
Besides the security fixes, iOS 27.2 brings a multi-view mode to iPhone so you can watch up to four live sports streams at once, voice assistant improvements, Dual Capture in group FaceTime calls, and support for older Apple TV remotes in Find My.
I have an old iPhone XS or XR. Is there an update for me?
Yes. Apple has released a fix for CVE-2026-86950, a CoreGraphics flaw that was exploited in targeted attacks, to older devices including the iPhone XS, iPhone XS Max and iPhone XR. Go to Settings, General, Software Update and install it.
How do I update to iOS 27.2?
Back up your iPhone, connect to Wi-Fi and a charger, then open Settings, General, Software Update and tap Update Now. The download is usually a few gigabytes, so it can take 15 to 30 minutes.