According to Apple's security bulletin, iOS 27.2.1 and macOS 27.2.1 were released on November 9, US time, to fix vulnerabilities such as iMessage groups and Bluetooth pairing. SlowMist 23pds says the new version can block DarkSword, malicious PDF vulnerabilities and worse_query. Apple and Google data show that the first two items have been patched in iOS 26.3 and 27.2 respectively, while worse_query is not listed in this announcement. (Previous summary: SlowMist warning: iPhone malware "DarkSword" has been weaponized and launched, and the encrypted mnemonic phrase may be stolen when opening a web page) (Background supplement: There are still loopholes after Apple blocks eMudhra: git and curl may still trust leaked credentials) Key summary Apple released iOS 27.2.1 on November 9, iPhone and iPad versions have 9 vulnerabilities and 2 iMessage patches The vulnerability may allow outsiders to join the group, or allow new members to read pre-group messages. The vulnerability used by DarkSword has been fixed in iOS 26.3, and the malicious PDF vulnerability has been fixed in iOS 27.2. Apple released iOS 27.2.1, iPadOS 27.2.1 and macOS Golden Gate 27.2.1 on November 9, US time, to patch security vulnerabilities in components such as iMessage, Bluetooth and AirPlay. According to Apple's iPhone and iPad security bulletins, 9 vulnerabilities have been patched this time; the Mac version bulletin lists 8 vulnerabilities. Neither announcement included a statement that "may have been exploited." 23pds, partner and chief information security officer of SlowMist, published a compiled article on X on the evening of November 10th, Taiwan time. Users are advised to update as soon as possible. He wrote that upgrading to 27.2.1 "not only prevents DarkSword attacks, but also prevents CVE-2026-112611 from processing malicious PDFs that cause memory corruption, and blocks the worse_query sandbox escape problem." Comparing Apple's announcement with other first-hand information, the patching status of these three items is different. iMessage groups can be joined remotely. Both iMessage vulnerabilities were reported by anonymous researchers. CVE-2026-113961 may allow a remote attacker to join an iMessage group and receive messages in the group. Apple has strengthened the verification patch. Another CVE-2026-113960 is that users who are pulled into a group may read messages before they join. Apple's approach is to directly remove the problematic code. There are 5 vulnerabilities related to Bluetooth and AirPlay. CVE-2026-113965 could allow a malicious Bluetooth device to complete pairing without user interaction. CVE-2026-113970 could allow an attacker within Bluetooth range to cause handler memory corruption. Memory corruption means that the data stored in the memory is overwritten when the program is executed. The remaining three are related to the rate limit of the pairing code. This limit is used to control the number of attempts to enter the pairing code within a period of time. CVE-2026-113968 and CVE-2026-113964 may allow an attacker within Bluetooth range to bypass this restriction, and the latter may also complete pairing without user action. CVE-2026-113969 could allow an attacker on the same network to bypass AirPlay pairing code attempt restrictions. The other two items are not listed in the 23pds collation. An authorization vulnerability (CVE-2026-113963) in the App Intents component may allow the app to access sensitive user data. This is only listed in the announcement for the iPhone and iPad versions. The vulnerability in the brotli compression component (CVE-2026-111497) is that processing malicious input may cause memory corruption. iOS 27.2.1 is suitable for iPhone 11 and later models. The iPad section covers iPad Pro 12.9-inch 4th generation, iPad Pro 11-inch 2nd generation, iPad Air 4th generation, iPad 9th generation, iPad mini 6th generation and later models. Apple's security update summary shows that watchOS 27.2.1, visionOS 27.2.1, as well as iOS 26.7.3, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3 for older systems were launched on the same day. eMudhra Credential Protection only covers Mac command line tools. The third item listed by 23pds, "eMudhra Credential Vulnerability: Adding Protection for Command Line Tools," is not included in the security advisory of 27.2.1. Its source is another Apple support document. The document pointed out that the private keys of eight intermediate certificate authorities (intermediate CAs) operated by Indian certificate provider eMudhra were leaked. Six of them are responsible for issuing TLS certificates for encrypted connections to websites. Anyone with these private keys can create credentials that appear valid on any website. Apple said that Safari, Mail and apps that use Apple's web framework will automatically block these credentials and do not need to update the system. Starting from macOS 27.2.1, command line tools such as curl and git built into macOS and included with Xcode Command Line Tools will also reject these credentials. macOS 26.7.3 and macOS 15.8.3 also include this protection. Dynamic Zone reported on October 29, and the research page pointed out at the time that macOS 27.2 on October 26 had not yet filled this gap. DarkSword and PDF vulnerabilities have been patched previously. DarkSword is an iOS attack tool disclosed by the Google Threat Intelligence Group (GTIG) in March this year. It concatenates 6 vulnerabilities to attack iOS 18.4 to 18.7. The GTIG report states that these six vulnerabilities have all been patched in iOS 26.3, and most of them were patched earlier. 27.2.1 also contains these fixes, which are patched in iOS 26.3 or earlier. CVE-2026-112611 is a vulnerability in CoreGraphics (the 2D drawing component of Apple systems) that may cause memory corruption when processing malicious PDF files. It is listed in the iOS 27.2 and iPadOS 27.2 security bulletin released on October 26 and is not on the list for 27.2.1. worse_query is an iOS sandbox escape (sandbox escape) proof-of-concept process published on GitHub by developer forcequitOS...〈iOS 27.2.1 update soon! The latest iMessage and Bluetooth pairing vulnerabilities can be hacked directly> This article was first published in BlockTempo, the most influential blockchain news media.