163 fixes, and Calif credits in the notes
Apple shipped iOS 27.2 and iPadOS 27.2 on October 26, and the security notes that arrived with the update turn last week’s speculation into something readers can check. Independent counts of the notes put the total at 163 unique CVE identifiers for iPhone and iPad, a figure reported by Notebookcheck and matched by other outlets counting the same Apple page. MacRumors describes the same release more loosely as fixing more than 160 vulnerabilities, and both descriptions point to the same fact. This is a very large patch, not a quiet bug fix release.
WebKit accounts for the largest block. Notebookcheck counts 34 entries for the browser engine and its related components, plus about 15 kernel flaws. Two individual fixes stand out for ordinary users. Apple says a remote attacker could access sensitive user data through an Apple Intelligence flaw, fixed with improved permissions checking, and a Hide My Email flaw in Mail could expose a user’s real email address, fixed with improved restrictions. Apple did not say any of the iOS 27.2 flaws were known to be actively exploited.
The jailbreak connection is in the credits. MacRumors counts six CVEs in the iOS 27.2 notes that credit Calif, the team behind the October 16 Hexacon demo and the iPhone Duo launch day jailbreak. Notebookcheck counts four entries credited to Calif, in a passage specifically about the Duo jailbreak. The two counts differ because they tally different things, Duo specific entries on one hand and all Calif credits on the other, so treat the exact Calif total as outlet counted, not as a single Apple headline number. What both counts agree on is the direction. Calif’s work is now visible in a shipping Apple patch.
What Esser’s “most” now means in a shipping build
Before release, Calif researcher Stefan Esser told German outlet Heise that most of the vulnerabilities behind the Hexacon demo were already fixed in the iOS 27.2 beta, and that Calif had no plans for an end user jailbreak tool. That statement was the reason our October 25 preview called iOS 27.2 the closest thing to a verdict day. Now the build Esser was describing is the build on everyone’s phone, and the security notes are public.
That changes the status of the claim in one important way, and leaves it unchanged in another. It is no longer a beta claim. The fixes Esser pointed to are in the release Apple shipped on October 26, for iPhone 11 and later. But “most” still does most of the work in that sentence. A chain needs every link. Patching most of a chain breaks it, but the notes alone do not name which Calif bugs belong to the Paris chain, and Apple does not claim any of them were in the demo. Until researchers diff the shipping build against iOS 27.0.1 and publish what they find, no one can say from the notes alone whether a shortened chain survives, or whether the whole chain is gone.
What the notes do not prove yet
Three questions remain open, and each has a different clock. First, patch diffing. Researchers compare the new build with the old one to see exactly which code changed, and that work takes days, not hours. Second, a fresh demonstration. Calif has promised a writeup in due time, with no date, and no new demo on iOS 27.2 has been shown. Third, a tool. There is still no public jailbreak tool for iOS 27.0.1, iOS 27.1, or iOS 27.2, and Calif has said it does not plan one for end users. Any website offering an iOS 27 jailbreak download today is selling something that does not exist, and fake tools are a common way to spread malware.
The distinction we drew in our secure boot chain explainer matters here too. A chain that lives in updatable software dies when Apple patches it. Only a flaw in the Boot ROM, which Apple cannot patch, or in a component Apple does not update through iOS, would survive every update. Nothing in the iOS 27.2 notes shows Calif’s chain resting on either exception.
The separate exploited flaw on older iPhones
October 26 brought one more update that deserves its own paragraph, because it is easy to confuse with the iOS 27.2 story. Apple also shipped iOS 18.7.11 for the iPhone XS, XS Max, and XR, and its advisory lists a CoreGraphics flaw, CVE-2026-86950, that Apple says may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. That exploited entry appears only on the 18.7.11 page, according to coverage of Apple’s advisories. It is not listed as exploited on the iOS 27.2 or iOS 26.7.2 pages. Owners of those older phones should install 18.7.11 promptly. Owners on newer phones should not read the exploited label as applying to their update.
Update now, unless you are holding out for a jailbreak
For almost everyone, the advice is simple. Install iOS 27.2, and keep Automatic Updates on so the next fix lands without a second thought. The update also unifies the iPhone Duo with other iPhones on the same version, and it brings five new Siri AI languages and other features on top of the security work. Devices that have not moved to iOS 27 get many of the same fixes in iOS 26.7.2, so staying on an older branch is not a reason to skip patching.
The exception is narrow, and it has a cost. If a future jailbreak matters to you, our Duo guidance still stands in its updated form. Staying on iOS 27.1 on the Duo, or iOS 27.0.1 on other iPhones, preserves whatever chance the chain has left. Updating to iOS 27.2 closes most of it, by Calif’s own account. Waiting costs nothing except the security fixes you postpone, because you can install 27.2 later, but you cannot count on going back once Apple stops signing the older version. That is a deliberate trade, not a default, and it only makes sense if you accept that no tool exists today and none has been promised.
We will report the patch diff findings and any Calif writeup as they land. For now, the honest summary is this. iOS 27.2 is out, its notes credit Calif’s research, most of the Hexacon chain is patched according to the researcher who built it, and the final word on what, if anything, survives still belongs to the researchers diffing the shipping build.
