Apple's iPhone update 27.2.1 fixes serious security flaws

Apple released iOS 27.2.1 on Monday, and it is worth installing right away. The update adds no new features. Its job is to close nine bugs, some of them serious security holes. iPads got a matching update, iPadOS 27.2.1.

What changed

Apple's release notes list nine separate fixes. Three stand out. In one, an app could be used to reach sensitive user data. In another, an attacker could pair with a person's device without that person doing anything. In a third, a remote attacker could join an iMessage group chat and receive its messages.

Why it matters

On Tuesday, the crypto exchange Binance pointed to a bug it called worse_query. It said the flaw affects iOS 26.7.1, 27.0.1 and 27.2, and lets a malicious app read local files from other apps. That could put seed phrases, private keys and login credentials at risk. A seed phrase is the set of secret words that unlocks a crypto wallet.

Binance stressed that this is an iOS-level issue, not one unique to its own app. In other words, it is a weakness in the phone's software, not in any one wallet or exchange. Binance also had a major security breach in late October.

What to do

The steps are in the alert box above. The short version: update your phone, update your apps, and remove anything you installed from outside official channels. Binance urged exactly this. If you have not moved to iOS 27, Apple has updates for older versions too, listed in the box.

What is not known yet

The material does not say whether attackers have used any of these flaws against real people. It also does not explain how a malicious app would end up on a phone, beyond Binance's warning about apps from untrusted sources. Apple's notes are brief, so details on each of the nine bugs are limited.

Until more is known, the safest move is the simple one. A few minutes in Settings closes holes that could expose your messages, passwords and crypto accounts.