What stands out in the iOS 27.2 security notes
iOS 27.2, released on October 26, fixed 163 CVEs, more than four times as many as iOS 26 a year earlier. OpenAI, Anthropic and the AI agent AiPy appear in the credits of 17 of them. Researchers from Calif, which showed an iOS 27.0.1 jailbreak ten days earlier, are credited on six. Other things that stood out include one bug reported by fourteen people and a four-year-old CVE number.
Apple released iOS 27.2 and iPadOS 27.2 on October 26. The security notes list 163 CVEs across 67 components. None of them carries the "may have been exploited" warning, which is good news, but you should still update now. I read the notes from top to bottom, and these are the parts I found interesting.
Four times as many in a year
The iOS 26 notes a year ago listed 36 CVEs. The 26.x updates that followed stayed roughly between 40 and 60, then iOS 26.6 in July jumped to 97, and iOS 27 in September reached 163. This release has 163 as well.
I don't think iOS suddenly got sloppier. It looks more like bugs are being found faster, and the credits below give some idea why.
iOS 26.7.2 and iPadOS 26.7.2 came out the same day. Devices that can't run iPadOS 27, such as the 12.9-inch iPad Pro (3rd generation), the iPad (8th generation) and the iPad mini (5th generation), get this update instead. It lists 134 CVEs, and 119 of them are the same as in 27.2, so older devices get most of the same fixes.
AI companies in the credits
The credits now mix company and tool names in with people.
- "OpenAI Codex Security - Amy Burnett" is credited on three WebKit bugs. Codex Security is the security agent OpenAI released in March 2026. One kernel bug credits just "OpenAI".
- "Chris Rohlf with Anthropic Research" is credited on three WebKit bugs. Rohlf works with Anthropic's Frontier Red Team, and on October 20 he published research on using Claude to cut down the attack surface of open-source projects.
- "Hcamael and 章鱼哥@aipy (aipyaipy.com)" appears on 11 CVEs, mostly in video codecs, fonts and 3D model parsing. aipyaipy.com is the site of AiPy, an AI agent made by the Chinese security company Knownsec.
Together, these three names appear on 17 CVEs.
These aren't minor bugs either. Nine bugs in this release are listed as leading to arbitrary code execution, and three of them credit OpenAI or Anthropic. One WebKit type confusion bug, CVE-2026-112659, credits both OpenAI Codex Security and Anthropic, which suggests the two companies found the same bug separately.
The credits don't say how much of the work the AI did. A person may have used AI as a tool, or an agent may have found most of it.
The link to last week's jailbreak
Ten days before this update, on October 16, the security firm Calif showed an iOS 27.0.1 jailbreak at Hexacon in Paris. It ran on an iPhone 18 Pro and survived a reboot, which heise called the first jailbreak of that kind since iOS 9. It started with one tap on a crafted PDF received through iMessage or Signal, and it reportedly got past MIE, Apple's newest memory protection.
At #hexacon - Calif.io demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro
Calif's Stefan Esser told heise that the jailbreak was built from bugs the company had already reported to Apple or was about to report, and that most of them were already fixed in the iOS 27.2 beta. He said AI helped too, but added that "pointing a model at an iPhone and telling it to hack it is still science fiction."
Demos we presented at Hexacon in Paris today. Everything will be released in due time.
1/ Signal 1-click
The 27.2 notes credit Calif researchers on six CVEs, including a CoreGraphics font bug with Stefan Esser's name on it. There are also two CoreGraphics bugs where a crafted PDF can corrupt memory. Apple's notes don't say which bugs the jailbreak used, so these six can't be called the jailbreak chain.
Fourteen people, one bug
Of the 163 CVEs, 65 credit more than one person or team, and 11 credit five or more. The record is CVE-2026-86925 in Quick Look, a bug that let an app reach sensitive user data, with fourteen names on it. An IOStorageFamily bug that let an app read kernel memory has ten.
Apple's notes list everyone who reported the same bug. A bug bounty usually pays only the first reporter, so most of those fourteen were probably marked as duplicates. My guess is that AI tools also play a part here, since they make the easier bugs reachable for more people at the same time.
Bugs that start with a file
44 of the 163 bugs are triggered by processing a crafted image, font, video, audio file, 3D model or PDF. That is the kind of bug where just previewing a file or receiving it in a message can be enough.
ImageIO alone has 11, and Mateusz Jurczyk of Google Project Zero found 9 of them. Nik Tsytsarkin of Meta Red Team X is credited on 14, across images, audio, 3D models and the kernel. Another Project Zero find, by Ivan Fratric, stands out: a crafted calendar invitation could corrupt memory.
One of my own ImageIO bugs (CVE-2026-28990) was fixed in iOS 26.5 in May. Image parsers are still where bugs turn up most steadily.
Other things worth noticing
- The Spotlight section lists CVE-2022-26704, a symlink handling bug that let an app gain elevated privileges. That four-year-old number belongs to a bug fixed in macOS Monterey 12.4 in May 2022. It now appears in the iOS notes with the same description and an extra credit for Gergely Kalman. Read literally, the same problem stayed in iOS for more than four years.
- Two fixes say the issue was "addressed by removing the vulnerable code": a MediaRemote bug that let an attacker on the local network corrupt memory, and a WebKit Process Model bug that allowed a WebKit sandbox escape.
- A website could use a media format that Lockdown Mode is supposed to block.
- A Mail bug could leak your real address even when you used Hide My Email. It is the only one of the 163 with no credit.
- In Apple Intelligence, an authorization bug let a remote attacker reach sensitive user data. It affects iPhone 15 Pro and later.
- Some attacks work from nearby: there are three Wi-Fi bugs, two Bluetooth bugs and one USB bug. One bug let a nearby attacker get into a Thread network, the kind smart home devices use. A Heimdal bug let an attacker impersonate a Kerberos server (KDC).
- The notes have typos too. One entry says "An malicious app", and a CoreAudio credit lists the same name, Altin Gashi, twice.
Korean researchers
27 CVEs credit researchers with Korean names. Kwak Kiyong and Song Nuri are credited together on 5. In WebKit, one name appears both as "Euntae Jang" and in Hangul as "은태 장", 6 bugs in total. Several credits are printed in Hangul.
Wrapping up
None of these bugs is marked as exploited, but 163 is a lot of fixes. If Calif is right that most of the jailbreak bugs are fixed in 27.2, there is even less reason to wait.
For researchers, three things stand out: the number of bugs in each note has quadrupled in a year, AI companies such as OpenAI and Anthropic now show up in the credits, and more people are finding the same bug at the same time. With bugs being found this fast, the race to find and report first has gotten tighter.
Sources: Apple security notes for iOS 27.2, iOS 26.7.2, Apple security releases, heise on the iOS 27.0.1 jailbreak demo, heise on how the Calif jailbreak works, Anthropic on attack surface reduction with Claude, Axios on OpenAI Codex Security, AiPy, NVD CVE-2022-26704.
