I highly recommend you update every Apple device you own, today. On November 9, 2026, Apple released nine security updates, including ones for iPhone, iPad, Mac and Apple Watch. I’d rather you get ahead of this one, so here is what’s wrong, here is how to fix it, and if you care to learn more, the deeper details are at the bottom.
Here’s what’s wrong
The two fixes that got my attention are both Bluetooth pairing bugs. Pairing is the step where two devices agree to connect, like your phone and your earbuds.
- With the first bug, a malicious Bluetooth device may be able to pair with yours without you tapping anything.
- With the second, someone within Bluetooth range may be able to get around the limit on how many times they can guess the pairing code, then pair with your device without you tapping anything.
Apple also fixed a few related problems:
- AirPlay (Apple’s tool for sending video and audio to a TV or speaker) had the same kind of code-guessing problem. One bug could be tried from Bluetooth range, and a separate one from the same network.
- On most devices, two iMessage group-chat bugs are fixed. With one, a stranger may be able to join a group chat and get its messages. With the other, someone added to a group may be able to read messages sent before they joined.
Here’s how to fix it
Updating is the fix, so update everything.
On an iPhone or iPad, go to Settings, then General, then Software Update. On a Mac, go to System Settings, then General, then Software Update. On an Apple Watch, open Settings on the watch, then General, then Software Update.
Want to learn more?
You can skip this part. Updating is what matters, and this section is just for anyone who wants the details. Every flaw below has a CVE number (a public ID that security folks use to track a specific flaw). The quotes are Apple’s own wording from its security notes.
The two Bluetooth pairing bugs are in CoreUtils (a behind-the-scenes part of Apple’s software), and both are fixed in all nine updates.
- CVE-2026-113965, found by Apple: “A malicious Bluetooth device may be able to establish a pairing without user interaction.” Apple says it fixed this “with improved checks.”
- CVE-2026-113964, found by an anonymous researcher: “An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.” A rate limit is the cap on how many guesses are allowed. Apple calls this a logic issue, fixed “with improved state management.”
The other fixes:
- Bluetooth, CVE-2026-113970, in all nine updates: “An attacker in Bluetooth range may be able to corrupt process memory.” Apple calls it a use-after-free issue (a mistake where software keeps using a piece of memory after it has let it go).
- AirPlay, CVE-2026-113968, in all nine updates: “An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.”
- rapportd (a background Apple service), CVE-2026-113969, in all nine updates: “An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts.”
- Messages, CVE-2026-113961: “A remote attacker may be able to join an iMessage group chat and receive its messages.”
- Messages, CVE-2026-113960: “A user added to an iMessage group may be able to access messages sent before they joined.” Both Messages fixes are in every update except iOS 18.7.12 and watchOS 26.6.1.
- App Intents (the part that lets apps hand actions to Siri and Shortcuts), CVE-2026-113963, in iOS and iPadOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1 only: “An app may be able to access sensitive user data.”
- brotli (a tool that shrinks data so it moves faster), CVE-2026-111497, in every update except iOS 18.7.12 and watchOS 26.6.1: “Processing maliciously crafted input may lead to memory corruption.”
- MediaRemote (a part of iOS and iPadOS), CVE-2026-113971, in iOS and iPadOS 18.7.12 only: “An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.”
You can read Apple’s full list here: https://support.apple.com/en-us/100100