Apple's iOS 27.2 patches a flaw that could let an app use the camera without asking. Apple has no sign it was used in attacks, but updating is still wise.
Apple has fixed a bug that could let a malicious app reach the camera on an iPhone or Mac without asking you first. The fix arrived this week in iOS 27.2, an update that patches more than 160 security flaws in total. Apple says it has no sign this one was used in real attacks.
The flaw is tracked as CVE-2026-86990 and was credited to researcher Mustafa Calap. It sat in CoreMedia, the part of Apple's software that apps use for audio and video. Apple's notes say only that "an access issue was addressed with improved access restrictions."
In plain terms, the pop-up asking whether an app can use your camera could have been skipped. On a Mac, that pop-up comes from a system called TCC, short for Transparency, Consent, and Control. It is meant to keep apps away from the camera until you say yes.
The article's author, who has long argued that camera covers are close to useless, says this bug does not change that view. It was not a hardware problem. The green indicator would still light up, because the bug skipped the permission, not the light. On an iPhone, that signal is a green dot in the status bar.
There is a catch. The light only helps if someone sees it. If you are away from your desk, or your phone is face down on a table, nobody would notice a live camera feed.
One tool that could help is OverSight, a free, open source app from Patrick Wardle. It alerts you each time the camera or microphone turns on and tells you which app did it.
Install the update for your device. Apple released fixes for several software versions:
Then review which apps can use your camera. On an iPhone, open Settings, then Privacy & Security, then Camera. On a Mac, open System Settings, then Privacy & Security, then Camera. Remove access for any app you no longer use or do not recognize.
Update your iPhone or Mac now, then remove camera access from any app you no longer use or do not recognize.
EA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a nameOpenAI released a ChatGPT for analysts and bankers that shows where each number came from, a feature that could matter well beyond finance.
Read more: OpenAI launches a ChatGPT built for Wall Street analystsA Kuala Lumpur firm now sells a SGD 1,500 check of what ChatGPT, Gemini, Perplexity and Google say about a named executive, after its founder's own test found mix-ups.
Read more: New Audit Checks What AI Chatbots Say About Business Leaders
