CONFIRMED
Apple has released iOS 27.2 and iPadOS 27.2, and MacRumors reports that the update fixes more than 160 security vulnerabilities. It also patches bugs behind Calif’s headline-grabbing iPhone jailbreak. If you have an iPhone, this is one to install today.
What we know
Apple shipped iOS 27.2 on Oct 26, 2026 (US time), about a month after iOS 27 arrived. Apple’s security page lists 163 CVE IDs for iOS and iPadOS 27.2, which MacRumors describes as more than 160 security vulnerabilities. Among them are more than 30 WebKit fixes and about 15 kernel fixes.
Two fixes stand out. One is an Apple Intelligence flaw that MacRumors says could let a remote attacker access sensitive data. The other is a Hide My Email bug that could leak your real email address.
You may have seen headlines saying iOS 27.2 fixes “hundreds” of bugs. That is not quite right for the iPhone. The 329 figure is 9to5Mac’s count of unique vulnerabilities across every Apple update released the same day, including macOS, watchOS, tvOS and visionOS. Counts vary by outlet, but the iPhone number from Apple’s notes is 163.
On the jailbreak, MacRumors reports that six CVEs in iOS 27.2 credit Calif, the team that jailbroke the iPhone Duo on launch day. Calif has said it will not release a jailbreak tool for regular users.
MacRumors also reports that Anthropic Research is credited on three fixes and OpenAI on four, and links the rising number of fixes to AI models getting better at finding bugs.
The “government advisory” you may have read about did not come from CISA or the US government. IBTimes India and Hans India report it came from India’s CERT-In, which rated it high severity on Oct 28, 2026, two days after Apple released the updates. According to those reports, CERT-In warns the flaws could let attackers run malicious code, gain privileges, steal data or bypass security protections, and it covers Macs, Safari, Apple Watch, Apple TV and Vision Pro too.
What we don’t know yet
Apple did not say any flaw fixed in iOS 27.2 is known to be actively exploited, per MacRumors. AppleInsider likewise says iOS 27.2 has no fix for a flaw used in targeted attacks. Separately, iTnews reports that iOS 18.7.11 brings a fix for a CoreGraphics bug that was exploited in the wild to the iPhone XS and XR, about four weeks after newer iPhones got it.
We also don’t know whether every piece of Calif’s jailbreak chain has been patched, or whether any remaining pieces will be fixed in a later update. Apple has not said the chain is fully closed.
What is rumored
German outlet Heise speculated, as relayed by a secondary aggregator site, that Calif may have found its iOS 27.0.1 jailbreak chain by comparing iOS 27.2 betas against 27.0.1 to spot what Apple had already fixed, with AI helping. Separately, iTnews says Calif previously said Anthropic’s Claude Mythos Preview helped it build an exploit.
What it means
Even with no confirmed attacks, MacRumors points out that once bug details are public, phones that are not updated could become targets. Waiting is the risky choice here.
Here is what to do now:
- iPhone or iPad: Go to Settings > General > Software Update and install iOS 27.2 (or iPadOS 27.2).
- iPhone XS, XS Max or XR: Install iOS 18.7.11, the newest release for those models, per CERT-In coverage.
- Mac: Go to System Settings > General > Software Update and install the newest version offered for your Mac.
- Turn on automatic updates on the same screen so future fixes arrive without you having to remember.
- If you are at higher risk, such as a journalist or activist, consider turning on Lockdown Mode for extra protection.
Plug in, connect to Wi-Fi, and let it run. A few minutes now closes 163 doors.