Apple Releases Security Updates After Discovering iMessage and Bluetooth Vulnerabilities
Apple has released several security updates after discovering weaknesses that could put users’ private messages and devices at risk. Some of these issues could allow someone to secretly join an iMessage group chat, read messages they were never supposed to see, or connect to an Apple device through Bluetooth without the owner’s permission.
One of the most concerning problems involves Apple’s iMessage service. Researchers discovered a vulnerability that could allow an unauthorized person to join a group conversation and receive messages without being invited. This means private conversations between friends, family members, or coworkers could potentially be exposed to someone who was never supposed to have access. The vulnerability is identified as CVE-2026-113961.
Apple also fixed a separate issue that could allow someone who was recently added to a group chat to see messages that were sent before they joined. Normally, when someone is added to a conversation, they should only have access to messages shared after they become a member. However, this weakness could expose earlier conversations as well. This vulnerability is tracked as CVE-2026-113960.
The security updates also address several problems involving Bluetooth, the technology that allows devices to connect wirelessly to headphones, speakers, computers, and other accessories. Some of these weaknesses could allow a nearby attacker or malicious device to connect to an Apple device without the owner having to approve the connection. Other issues could allow someone nearby to get around the normal limits on how many times they can try entering a Bluetooth pairing code.
Apple also addressed a security issue involving AirPlay, which allows users to stream videos, music, and other content between Apple devices and compatible televisions or speakers. The weakness could allow someone on the same network to bypass restrictions designed to prevent repeated attempts at entering a pairing code. Another Bluetooth-related issue could potentially cause problems with how a device handles information in its memory, creating another opportunity for an attacker to interfere with the system.
In addition to these issues, Apple included a fix for a problem in Google’s Brotli software, which is used to make files and information smaller so they can be transferred more efficiently. The weakness could allow specially designed information to damage parts of a device’s memory while being processed. This particular issue is especially important because the U.S. Cybersecurity and Infrastructure Security Agency had already added it to its list of known exploited vulnerabilities, meaning it had been identified as a security issue that attackers have used in real-world situations.
Apple released updates across several of its operating systems, including iOS, iPadOS, macOS, watchOS, and visionOS. However, not every update includes the fixes for the iMessage and Brotli problems. Some updates released for older devices, including the iPhone XS, XS Max, XR, and seventh-generation iPad, do not list these particular fixes. Apple has not clearly explained whether those devices are affected or whether additional updates will be released.
At this time, Apple has not confirmed whether the two iMessage vulnerabilities have been used in actual attacks. The company has also not provided many details about how someone would take advantage of these weaknesses or whether users would notice if someone gained access to a group conversation.
For Apple users, the most important step is to check for available software updates and install them as soon as possible. This can usually be done by opening the Settings app, selecting General, and choosing Software Update on an iPhone or iPad. Mac users can check for updates through System Settings.
These discoveries are a reminder that even devices and applications people use every day can have security weaknesses. Private messages, wireless connections, and personal information all need protection. Keeping devices updated is one of the easiest ways to reduce security risks and help prevent attackers from taking advantage of known vulnerabilities.
