Apple's November updates: check your company iPhones
Apple fixed Bluetooth, AirPlay and Messages flaws on November 9, as CISA warned an old Apple bug is hitting unpatched devices. What offices should check.
On Monday, November 9, 2026, Apple released security updates for iPhone, iPad, Mac, Apple Watch and Vision Pro. The fixes deal mostly with Bluetooth, AirPlay and Messages. None of them are reported as exploited so far. But the same week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are using a much older Apple flaw against devices that were never updated. Together, the two stories are a good reason to check every iPhone and iPad your business relies on.
What Apple fixed on November 9
According to Apple's security releases page, the updates are iOS and iPadOS 27.2.1, iOS and iPadOS 26.7.3, and iOS and iPadOS 18.7.12, along with macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3. Apple's notes for iOS 27.2.1 describe several issues worth knowing about:
- a malicious Bluetooth device could pair with an iPhone without the user doing anything;
- a nearby attacker could corrupt memory through a Bluetooth bug, and others could get around the limit on how many times an AirPlay pairing code can be guessed;
- in Messages, a remote attacker could join an iMessage group chat and receive its messages, and someone added to a group could see earlier messages.
TidBITS notes that none of the flaws appear to have been exploited in the wild, and MacRumors points out that Apple has not said otherwise. The older iOS 18.7.12 release covers the iPhone XS, XS Max, XR and the 7th-generation iPad.
Why an old flaw is back in the news
On November 4, CISA added CVE-2024-27834 to its catalog of known exploited vulnerabilities. The Hacker News reports that Apple fixed it back in May 2024 (in iOS 17.5 and macOS Sonoma 14.5, among others), and that attackers are now using it against devices that never received that fix, to steal browser cookies that can let them into online accounts. Federal agencies have until November 18 to patch.
The lesson for a small business is simple: a phone that stopped updating two years ago is still carrying two-year-old holes, and attackers know that.
What to do with company iPhones and iPads
- Check the version on each device. Go to Settings, General, About. Anything below the November 9 releases should be updated through Settings, General, Software Update.
- Find the devices that cannot update. An iPhone older than the XS or XR no longer gets these fixes. If it still opens company email, files or banking apps, plan to replace it.
- Don't forget shared and personal devices. Front-desk iPads, a manager's old phone kept as a spare, and personal phones that receive work email all count.
- Use your device management tool if you have one. Most MDM tools can show versions across all devices and set a deadline for updates, which is far more reliable than reminders.
- Update Macs too. The same Bluetooth and Messages fixes are in the macOS releases listed above.
Where we can help
Keeping phones, tablets and computers on current versions is part of our patch management service, alongside managed IT services for small offices. If a device has gone missing rather than out of date, see our guide to a lost or stolen company laptop, and for hardware problems our Apple Mac repair team can take a look. Call (213) 986-4855.