Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
AI-summarised brief · reviewed before publication
Apple released security updates that close two iMessage group‑chat vulnerabilities—CVE‑2026‑113961, which could let a remote attacker join a chat and read messages, and CVE‑2026‑113960, which could expose messages sent before a new participant was added. The patches also address a Brotli compression library flaw (CVE‑2026‑111497) and several Bluetooth and AirPlay issues that could enable unauthorized pairing or memory corruption. Updates were issued for iOS 18.7.12, iPadOS 18.7.12, watchOS 26.6.1 and related devices, though release notes for some models (iPhone XS/XS Max/XR, 7th‑gen iPad, certain Apple Watches) do not list the iMessage fixes. Apple provided no details on exploitation, required attacker capabilities, or whether all users must update to stay protected.
💡 Why It Matters
- · The flaws could have allowed silent eavesdropping on private conversations, exposing users to covert surveillance without any visible indication.
- · Fixing them now prevents attackers from leveraging widely deployed Apple devices as unnoticed listening posts.