Update Your iPhone to Prevent People From Seeing iMessages They Shouldn't

Jake Peterson Jake Peterson Senior Technology Editor ExperienceJake Peterson is Lifehacker’s Tech Editor, and has been covering tech news and how-tos for nearly a decade. His team covers all things technology, including AI, smartphones, computers, game consoles, and subscriptions. Read Full Bio November 9, 2026 Add as a preferred source on Google Add as a preferred source on Google Credit: Osmancan Gurdogan/Anadolu via Getty Images Key Takeaways Apple just patched two iMessage bugs. Both let people see text messages they shouldn't have access to. One flaw lets new group chat members see messages from before they were added. Another flaw lets remote attackers join your iMessage chat and receive new messages. Apple fixed these two flaws, plus others, in a slate of updates it released on Monday. Table of Contents Has this ever happened to you? You add someone new to an iMessage group chat, and wonder, "Huh, can they see any of the messages from before they were added?" The answer to that question is supposed to be "no." By design, new iMessage group chat members are only privy to texts that arrive after they were added. When they join, it's essentially a blank slate, as if you just created the group for the first time. At least, that's how it's intended to work. iMessage currently has two security flaws As it turns out, there's a bug with iMessage that may allow new group chat members to see texts from before they were added to the chat. That's a problem, and not just for the iPhone users out there talking smack about people before inviting them to join the group chat. It means iMessage, and Apple's platforms in general, aren't working like they're supposed to be. You don't have to be talking behind people's backs to not want new members seeing existing chats. Maybe you're planning a surprise party for someone, and add them to the group once everyone's in on the plan; maybe the texts in the chat aren't relevant to the current group, and the person joining simply does not need to access them. That's not all: There exists another security flaw that could allow remote hackers to join an iMessage group and receive new messages. You might add a new user to a group chat and inadvertently invite them to read all existing messages, while at the same time being attacked by a bad actor who can then intercept all future messages. Not good. iOS 27.2.1 patches this bug and eight moreLuckily, there's currently a fix for these problems. Apple patched (and revealed) the bugs, along with seven other security flaws, with a series of software updates on Monday for iPhone, iPad, Mac, Apple Watch, and Vision Pro. Not all of the updates include patches for these two iMessage flaws—specifically, some of the updates for older Apple devices. But the rest, including iOS 27.2.1, macOS 27.2.1, macOS 26.7.3, macOS 15.8.3, watchOS 27.2.1, and visionOS 27.2.1, include the iMessage patches. Each update includes its own list of patches, but, for this article, I'll take a look at the nine patches in iOS 27.2.1. You'll find the two iMessage bugs, plus seven other patches, in the list below: What do you think so far? AirPlay: Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts. Description: A logic issue was addressed with improved state management. CVE-2026-113968: AppleApp Intents: Impact: An app may be able to access sensitive user data. Description: An authorization issue was addressed with improved state management. CVE-2026-113963: László VáradyBluetooth: Impact: An attacker in Bluetooth range may be able to corrupt process memory. Description: A use-after-free issue was addressed with improved memory management. CVE-2026-113970: Applebrotli: Impact: Processing maliciously crafted input may lead to memory corruption. Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-111497CoreUtils: Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction. Description: This issue was addressed with improved checks. CVE-2026-113965: AppleCoreUtils: Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction. Description: A logic issue was addressed with improved state management. CVE-2026-113964: an anonymous researcherMessages: Impact: A remote attacker may be able to join an iMessage group chat and receive its messages. Description: An authorization issue was addressed with improved validation. CVE-2026-113961: an anonymous researcherMessages: Impact: A user added to an iMessage group may be able to access messages sent before they joined. Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: an anonymous researcherRapportd: Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts. Description: A logic issue was addressed with improved state management. CVE-2026-113969: AppleFor a full accounting of the patches included in the other security updates, check out Apple's official security releases site. How to patch these iMessage flawsTo install Apple's latest security updates, you'll simply need to update your device as you usually do. On iPhone, iPad, Apple Watch, and Vision Pro, head to Settings > General > Software Update; on Mac, go to System Settings > General > Software Update. Here, follow the on-screen instructions to download and install the latest version of your device's software.