[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhL6u-70QTI7fTPv_QReQeEabrvi_7GncqF9emouTy28":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"065e4eb7-6140-452b-a429-c47c3e269742","Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities","apple-patches-imessage-group-chat-privacy-flaws-and-bluetooth-pairing-vulnerabil-fdab5e","An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple","Apple has released updates to address two critical iMessage privacy flaws. One flaw could allow a remote attacker to join a group chat and receive its messages, while another would permit someone added to a group to access messages sent before their addition. The updates also fix a Brotli compression library flaw and several Bluetooth and AirPlay vulnerabilities, some of which could allow unauthorized pairing or memory corruption.","Apple releases updates for iMessage privacy flaws and Bluetooth pairing vulnerabilities.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fapple-patches-imessage-group-chat.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiUM6RGvSNUqube0TIXYpzHhs7uSvT0k28f2Q8s-GVOexnCI4T5mzFMUs3Lz4_aS6gNuS71DSTvtfOO-tfVFXvVu82pBmj5gO5_jO5g1ndVQQX8xjBY8A_IDAVNkO7oE1s5FRyEsxXQ_HEM_5_KI4g9VWN8BLgCmQTS1DaFt6lRlfgEJMsxyC5bxQW1qhM\u002Fs1600\u002Fapple-patch.jpg","2026-11-10T10:16:51+00:00","2026-11-10T11:00:27.343236+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"iMessage","product",{"name":21,"type":19},"Brotli",{"name":23,"type":24},"Apple","vendor",{"name":26,"type":24},"Google",{"name":28,"type":29},"Bluetooth","technology",{"name":31,"type":29},"AirPlay","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},[51,55,58],{"type":52,"value":53,"context":54},"cve","CVE-2026-113961","Authorization issue in iMessage allowing remote attacker to join group chat.",{"type":52,"value":56,"context":57},"CVE-2026-113960","iMessage flaw allowing access to prior messages after being added to a group.",{"type":52,"value":59,"context":60},"CVE-2026-111497","Out-of-bounds write in Google's Brotli compression library decoder.",[23,26,18],{"controls":63,"vendors":129},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[127,128],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},[130,135],{"slug":131,"name":23,"logo_path":132,"roles":133},"apple","\u002Fvendor-logos\u002Fapple.png",[134],"affected",{"slug":136,"name":26,"logo_path":137,"roles":138},"google","\u002Fvendor-logos\u002Fgoogle.png",[134],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"apple-imessage-and-bluetooth-flaws-expose-chat-privacy-and-unauthorized-pairing-risks","Apple iMessage and Bluetooth Flaws Expose Chat Privacy and Unauthorized Pairing Risks","Apple's iMessage group chat vulnerabilities reveal how flawed access control logic in messaging protocols can expose private communications to unauthorized parties — both by allowing uninvited users to join chats and by granting new members access to historical messages they should never have seen. The Bluetooth pairing vulnerabilities compound the risk by enabling unauthorized device connections and potential memory corruption, widening the attack surface on Apple devices. These flaws matter because they affect hundreds of millions of devices globally, and unpatched systems remain exposed until users manually or automatically apply updates. Prompt patching is the single most effective control in this scenario, as Apple has already released the fixes.",[144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":152,"NIS2 Article 21(2)(b)":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"iMessage group chat content can include personal data; the ability for unauthorized parties to intercept or access those messages represents a failure to implement appropriate technical measures to ensure confidentiality, as required by Article 32.","NIS2 requires entities to implement measures for incident handling and vulnerability management; the Bluetooth and iMessage flaws affecting critical communication channels fall squarely within the scope of vulnerabilities that must be addressed under this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws — directly applicable here as Apple released patches that organizations are obligated to apply promptly to close the iMessage and Bluetooth exposure.","The Brotli compression library flaw embedded in Apple's software is a classic example of a vulnerable third-party component that persists in production until actively patched, which A06 specifically calls out as a top risk.","The iMessage and Bluetooth vulnerabilities had vendor-supplied patches available; a continuous vulnerability management process with defined patching SLAs would have ensured timely remediation across all Apple devices.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, which would have driven organizations to track and apply Apple's critical patches as soon as they were released.","The flaw allowing unauthorized users to join iMessage group chats and read historical messages is a direct failure of access control — PR.AA requires that access to resources be properly managed and restricted to authorized identities only."]