Apple released iOS 27.2.1, iPadOS 27.2.1 and macOS 27.2.1 on 9 November. They are small updates, but worth installing this week.
What was fixed
The iPhone and iPad update fixes nine security flaws, and the Mac update fixes eight. Several involve Bluetooth and AirPlay pairing with nearby devices. One could let a remote attacker join an iMessage group chat and read its messages. Apple does not say that any of them has been used in attacks.
The iPhone and iPad update is available for the iPhone 11 and later, and for the iPad models Apple lists in its notes.
What the certificate part means
Certificates work like ID cards for websites. When your browser shows a secure connection, it has checked that the site's certificate was issued by a trusted authority.
The private keys of eight certificate authorities run by eMudhra were compromised, according to Apple. With those keys, someone could create certificates that look valid for any website. eMudhra and Sectigo have revoked the affected certificates.
You don't need to do anything special. Apple already blocks the 12 affected certificates in Safari, Mail and apps that use Apple's frameworks, and those updates reach your devices automatically. The new macOS update extends the block to developer tools such as curl and git.
Why it matters
In our view, this is security working as it should: a problem found, blocked and fixed, with one simple step left for you. Keeping your devices updated is still the single most useful habit for staying safe online. Read more about how we think about security by design.