iOS 27.2: Apple patches 163 vulnerabilities, including those used in the iPhone Duo jailbreak

Apple rolled out iOS 27.2 and iPadOS 27.2 on Monday evening, and this time the update is above all one thing: a big repair job. Apple's security page lists 163 CVE IDs for iPhone and iPad, and across all of Apple's platforms 9to5Mac counts at least 329 closed vulnerabilities. What is in it, and how urgent is the update?

As usual, WebKit accounts for the largest block: 34 entries concern the browser engine and its related components, plus 15 kernel flaws. Two individual cases sound more delicate. According to Apple, a remote attacker could access sensitive user data through Apple Intelligence, and of all things Hide My Email – the feature meant to protect your real address – could leak it in Mail. Apple does not say that any of these flaws have been actively exploited.

The acknowledgements are telling. Four entries are credited to Calif, the team that demonstrated a jailbreak of the iPhone Duo on launch day. Calif researcher Stefan Esser told MacRumors that iOS 27.2 fixes most of the vulnerabilities used for it – bad news for jailbreak fans, good news for everyone else. Apple credits three further findings to Anthropic Research and four to OpenAI: AI-assisted bug hunting has arrived in everyday patching.

Besides the fixes, there are a few features. Multiview comes to the iPhone, letting you follow up to four live streams from the Apple TV subscription at once, such as MLS matches – Formula 1, however, only in the US. The second- and third-generation Siri Remote now also shows up in the Find My app; it could be located with an iPhone since iOS 17, but it was missing from the app until now. Anyone still avoiding iOS 27 gets many of the security fixes with iOS 26.7.2.

The recommendation is therefore clear: install it, and soon. Apple does not report any ongoing attacks, but with the security page published, the vulnerabilities are out in the open – and anyone who does not update remains exposed to exactly that.