iOS 27.2 Security Update: 163 Fixes, WebKit Flaws and Why to Update Now

On October 26, 2026, Apple released iOS 27.2 and iPadOS 27.2 with fixes for 163 security vulnerabilities. The update covers the iPhone 11 and later and most recent iPads. The most serious problems are in WebKit, the engine that shows web pages in Safari and in most apps on iPhone and iPad. In Apple's own words, "processing maliciously crafted web content may lead to arbitrary code execution": a web page built to attack could run code on your device.

Apple does not say these flaws have been used in attacks. That is not a reason to wait. A published fix tells attackers exactly where to look, and phones that never update stay open to it. This post explains the iOS 27.2 security update in plain English: what it fixes, which update your device needs, and what businesses should do.

What does the iOS 27.2 security update fix?

Apple's security notes for iOS 27.2 list 163 vulnerabilities across the system. The largest group is WebKit, followed by the kernel (the core of the operating system) and ImageIO (the part that opens pictures). Many are in the parts that open web pages, pictures, audio and video.

The ones that matter most are the flaws Apple rates as able to run code:

• Eight WebKit flaws where malicious web content may lead to arbitrary code execution (CVE-2026-112623, CVE-2026-112626, CVE-2026-112637, CVE-2026-112639, CVE-2026-112651, CVE-2026-112655, CVE-2026-112659 and CVE-2026-112697).
• One CoreMedia flaw where opening a crafted media file may lead to arbitrary code execution (CVE-2026-112688).

Why the WebKit flaws matter most

On iPhone and iPad, Safari runs on WebKit, and so do most other browsers and nearly every screen inside an app that shows a web page: links opened in a social or messaging app, sign-in pages, help pages, payment screens. A WebKit flaw is reachable through any of them, simply by loading the wrong page. That is why a WebKit code-execution fix is the kind of update to install the same day.

Is iOS 27.2 fixing flaws used in real attacks?

Not according to Apple: its notes for iOS 27.2 do not report any of these flaws as exploited.

The same day, Apple also released iOS 18.7.11 for older devices that cannot run iOS 27 (iPhone XS, iPhone XS Max, iPhone XR and some older iPads). It contains only three fixes, but one of them, a CoreGraphics flaw (CVE-2026-86950), carries Apple's warning that it "may have been exploited in an extremely sophisticated attack against specific targeted individuals". If you or your team still use one of those phones, that update is the most urgent of all.

Which update does my device need?

Staying on iOS 26 is a supported choice, but iOS 26.7.2 does not carry every fix in 27.2. If your iPhone can run iOS 27, iOS 27.2 is the complete one.

How to update to iOS 27.2

Go to Settings > General > Software Update, install the update, and let the phone restart. While you are there, turn on Automatic Updates so the next security release installs overnight without you having to remember. The fix only protects the device once it has restarted on the new version.

What businesses should do

• Company phones and iPads: if you manage devices, set the minimum version to iOS 27.2 (or 26.7.2) and check which devices have not installed it. A phone that never updates is the one an attacker finds.
• Your own iPhone app: screens in your app that show web pages use Apple's built-in WebKit, so they are fixed by the iOS update, not by an app update. Your app's web screens are only as safe as your users' iOS version, which is a good reason to check which versions your users actually run.
• Staff with older phones: an iPhone XS or XR needs iOS 18.7.11 today, because of the exploited flaw above.

iOS 27.2 questions people are asking

Should I update to iOS 27.2?

Yes. It fixes 163 security flaws, including eight in WebKit that could let a malicious web page run code on your device. Install it as soon as you can.

Is iOS 27.2 safe to install?

It is an official Apple release, published October 26, 2026, through Settings > General > Software Update. As with any update, make sure your phone is backed up first.

Is iOS 27.2 fixing an actively exploited vulnerability?

Apple does not report any of the iOS 27.2 flaws as exploited. The exploited flaw Apple fixed that day is in iOS 18.7.11, for the iPhone XS, XS Max and XR and some older iPads.

What is WebKit?

WebKit is the engine that draws web pages on Apple devices. Safari uses it, and so do most browsers and in-app web screens on iPhone and iPad, which is why WebKit flaws reach so many people.

My iPhone cannot get iOS 27. What should I do?

Install the newest update your device offers: iOS 26.7.2 if it can run iOS 26, or iOS 18.7.11 for the iPhone XS, XS Max and XR.

Do I need to update my apps too?

Keep apps updated as a habit, but the WebKit fixes in this release come from the iOS update itself. Updating apps without updating iOS leaves these flaws open.

The bigger lesson

Phones are now where a lot of business happens: email, banking, customer messages, the apps your clients use. They need the same discipline as servers: know what versions are running, update the day a fix ships, and check the update actually landed. We wrote more about that in Updated Is Not the Same as Patched.

If you want an iPhone app built to stay secure after launch, or someone to keep your company's software and devices up to date, see our iOS app development and security review and hardening services, or get a tech quote.

Sources: Apple - About the security content of iOS 27.2 and iPadOS 27.2; Apple - iOS 26.7.2 and iPadOS 26.7.2; Apple - iOS 18.7.11 and iPadOS 18.7.11; Apple security releases; Cybersecurity News; SecurityWeek.