Apple’s iOS 27.2 security update, released October 26, 2026, comes with an advisory of well over 100 separate entries, according to Apple’s security content page. The page flags none of them as exploited in the wild, but the sheer volume is the story. If you skipped the update because the Siri changes did not interest you, the fixes underneath are the better reason to install it.
TL;DR: iOS 27.2 patches well over 100 vulnerabilities across iPhone 11 and later, with WebKit, the engine behind Safari, taking the largest share. Apple does not mention any active exploitation. The fixes include a Hide My Email leak in Mail and several flaws that let an app reach sensitive data. Installing it takes a few minutes and closes the biggest web exposure.
What the iOS 27.2 security update fixes
Apple’s advisory says it “describes the security content of iOS 27.2 and iPadOS 27.2,” and most entries apply to iPhone 11 and later. The list runs across dozens of components, from Wi-Fi and Bluetooth to Photos Storage, Spotlight and Shortcuts.
WebKit dominates. The heading “WebKit” alone carries 16 entries, and related WebKit and WebRTC headings add several more. The Kernel and ImageIO groups follow, mostly memory handling bugs.
No single fix looks like the headline. The value here is in the total, because every one of those bugs was a door someone could have tried.
Why the WebKit entries matter most
Several WebKit entries describe the same outcome: processing maliciously crafted web content may lead to arbitrary code execution. In plain terms, a booby trapped page could run code on your phone if you open it.
One WebKit Process Model entry, CVE-2026-113897, says a remote attacker may be able to break out of the Web Content sandbox. Apple’s fix was “removing the vulnerable code,” which is a more drastic repair than the usual bounds check.
Because Safari and most other iPhone browsers run on WebKit, this is the part of the update that protects you whichever browser you open.
Privacy fixes in Mail, Siri and Safety Check
Mail has three entries. One, CVE-2026-112500, says the user’s original email address may be leaked when using the Hide My Email feature. If you use Hide My Email to keep a shopping address private, that is exactly the protection it was meant to give you.
Siri has two entries where an app may be able to access sensitive user data, and Safety Check has one with the same impact. Safety Check is the tool for reviewing and stopping what you share with other people, so a flaw there deserves attention.
Apple Intelligence also gets a fix for an authorization issue that could let a remote attacker access sensitive user data, on iPhone 15 Pro and later.
Who found the bugs
Apple’s credit lines name OpenAI Codex Security on three WebKit entries, and one of them also credits Chris Rohlf with Anthropic Research. That is the detail most coverage will skip, and it shows how much of the bug hunting now involves AI security tools alongside individual researchers.
Apple does not explain how any of these bugs were found, so the credits alone do not tell us how much work the tools did.
What to do before you dismiss the update prompt
Install it, ideally on Wi-Fi and while the phone is charging. The release also brings the new Siri excluded apps setting, so you can tidy up Siri’s access in the same sitting.
Photos fans get changes too, covered in our Shared Albums and SynthID piece. Neither is a reason to wait.
For most people this will be invisible until the one moment it is not. A patched phone simply never has that moment, and Apple has given you more than 100 reasons to be on the patched side.
