The iMessage Group Chat Bug Fixed in iOS 27.2.1: Who Could Read What, and What to Do Now
Part of: Encryption basics, without the jargonChecked against Apple's release notes as reported by iDrop News and Cybersecurity News, 12 November 2026. Apple's own security page lists the official wording.
On 9 November 2026 Apple released iOS 27.2.1 (and iOS 26.7.3 for people who stayed on iOS 26) with nine security fixes. Two of them are about iMessage group chats, and they touch the thing people assume most about a group: that only the members, and only from the moment they joined, can read it (iDrop News, Cybersecurity News).
Short answer: update now: Settings > General > Software Update to iOS 27.2.1 (or 26.7.3). The fixed bugs could let someone added to an iMessage group read messages sent before they joined, and, in Apple's words, let "a remote attacker... join an iMessage group chat and receive its messages." Apple does not say either bug was used in real attacks. After updating, check the member list of groups where you share sensitive things.
The two group chat bugs, in plain words
| Apple's description | What it means | Fix |
|---|---|---|
| "A user added to an iMessage group may be able to access messages sent before they joined." | Normally a new member sees only new messages. With this bug, someone added later may have seen older ones. | iOS 27.2.1 and 26.7.3 ("removing the vulnerable code") |
| "A remote attacker may be able to join an iMessage group chat and receive its messages." | Someone who should not be in the group could get in and receive messages. | iOS 27.2.1 (stronger checks on who can join) |
Reports list them as CVE-2026-113960 and CVE-2026-113961, both found by researchers who asked not to be named (Cybersecurity News). The word "may" matters: Apple does not describe when it happened, and iDrop News notes there would be no obvious sign on your screen that a new member could see older messages. iOS 18.7.12 did not list the first bug, which suggests it came with newer versions.
What else iOS 27.2.1 fixes
Most of the other fixes are about Bluetooth and AirPlay pairing: people in Bluetooth range could get around pairing-code limits or pair without you doing anything, and one memory bug could corrupt a process. There is also an App Intents fix where an app could reach sensitive data. Updates also went out for iPadOS, watchOS, visionOS and macOS (iDrop News).
What to do in the next ten minutes
- Update: Settings > General > Software Update. Turn on Automatic Updates and Security Responses & System Files while you are there.
- Update your other Apple devices (iPad, Mac, Watch). An old device in your account can still be in your groups.
- Open your important groups and tap the group name to see who is in it. Remove anyone you do not recognise.
- Think about what was shared before someone joined. If a person joined a sensitive group recently, assume they may have seen earlier messages and act accordingly (change a shared code, for example).
- Bluetooth and AirPlay: until every device is updated, switch them off when you are not using them.
The bigger lesson about group chats
End-to-end encryption protects messages on the way, but a group is only as private as its member list. That is why "who can join" matters as much as the encryption: approval for newcomers, clear notices when someone is added, and a short list you check now and then. It is the same lesson as the green-bubble problem: RCS messages between iPhone and Android depend on both phones and both carriers, and an Apple threat notification is about your device, not your app. For how group encryption works at all, see end-to-end encrypted group chats.
Where Nadeemi fits
Nadeemi is the app we build, so weigh this section accordingly, and no app is free of bugs, ours included. Nadeemi group chats show who is in the chat, and an admin can turn on approval so new people wait until an admin lets them in (how approval works). In Nadeemi, someone added to a group chat sees only the messages sent after they join. It needs no phone number and no email, has no ads, works on iPhone, Android and computers from the website, in Arabic and English.
FAQ
What iOS version fixes the iMessage group chat bug? iOS 27.2.1, released 9 November 2026. If you stayed on iOS 26, iOS 26.7.3 fixes the "earlier messages" bug.
Could strangers read my iMessage groups? Apple says a remote attacker "may" have been able to join a group and receive its messages. It does not say this was used in real attacks. Update to close it.
Could a new group member see old messages? With the bug, possibly. Apple says a user added to a group "may be able to access messages sent before they joined."
Do I need to do anything besides updating? Update all your Apple devices and check the member lists of important groups.
Was the bug exploited? Apple has not said that any of these flaws were used in real attacks.
Sources (checked 12 November 2026)
- iDrop News, Apple Releases iOS 27.2.1 to Fix a Sneaky iMessage Group Chat Privacy Bug (9 Nov 2026): https://www.idropnews.com/?p=270838
- Cybersecurity News, Apple fixes 9 security vulnerabilities in iOS 27.2.1 (10 Nov 2026): https://cybersecuritynews.com/apple-fixes-security-vulnerabilities/
- Apple, Apple security releases: https://support.apple.com/en-us/100100
Names of other apps are trademarks of their owners, used only for comparison. Nadeemi is not affiliated with any of them.
Drafted with AI help and checked by a person on the date above.