Все ваши устройства Apple должны быть исправлены как можно скорее – вот почему

• Apple выпустила 12 обновлений программного обеспечения для устранения проблем с безопасностью.
• Это касается iPhone, iPad, Mac, Apple Watch и устройств Vision Pro.
• Исправления безопасности направлены на устранение уязвимостей беспроводной сети.

Во вторник Apple выпустила исправления безопасности для iOS, iPadOS, macOS, watchOS и VisionOS, которые устраняют недостатки беспроводной безопасности в сопряжении Bluetooth, AirPlay и сообщениях.

Согласно замечаниям Apple по безопасности, уязвимости могут позволить злоумышленникам установить Bluetooth-соединение без участия пользователя, обойти ограничения скорости подключения AirPlay, а также присоединиться к групповому чату iMessage и получать его сообщения. Примерно половина из этих уязвимостей была обнаружена Apple самостоятельно, в то время как другие были предоставлены исследователями.

Applesecurity notes list a fix for Messages to prevent attackers from remotely joining an iMessage group chat and reading its messages. According to Apple, "an authorization issue was addressed with improved validation" to fix the issue.

There was likely a flaw in Apple’s iMessage authorization logic that allowed an unauthorized user to inject themselves into a group chat roster without permission from an existing member.

Also: Your iPhone can spot scams for you with iOS 27

Another issue in Messages could allow an authorized added member to access messages within a group chat that were sent before they joined. According to Apple, the code that caused this issue has been removed.

One security fix across devices and software versions addresses an issue where a malicious actor could establish a Bluetooth connection to your device without user interaction.

Apple was not specific about which kind of Bluetooth attack this fix addresses; however, it’s reminiscent of Bluetooth Low Energy Re-Pairing vulnerabilities found earlier this year by French researchers.

This study explains how bad actors can exploit vulnerabilities in Bluetooth Low Energy pairing logic to execute one-click or zero-click impersonation and man-in-the-middle attacks against unsuspecting devices, regardless of Bluetooth version or security level.

Also: Beware of Bluetooth sniffers: Your favorite gadgets could expose you

The study was published in January of this year, and the researchers reported initial findings to Apple, which "[appeared] to have hardened the re-pairing logic in MacOS/iOS 26," according to the study. It’s possible that Apple internally found another vulnerability in the same Bluetooth pairing logic, given how many devices across Bluetooth versions are affected.

According to Apple, this issue was fixed with "improved checks," likely meaning strengthened verification steps during pairing.

Another vulnerability pertains to AirPlay, allowing an attacker within Bluetooth range or on the same network to bypass the rate limit on AirPlay pairing code attempts. This issue also affects iOS, iPadOS, MacOS, VisionOS, and WatchOS.

This vulnerability is similar to the AirBorne attack method. This report, published in 2025 by Oligo, describes how zero-click remote code execution, user-interaction bypass, denial-of-service, man-in-the-middle, and other techniques can be used to take control of a device that supports AirPlay.

However, the current security issue is likely less serious or far-reaching and was discovered internally.

For this issue, when you pair a device with an AirPlay receiver, such as an Apple TV, AirPlay-enabled TV, or Mac, it will prompt you for a security PIN to verify your device. You can only input an incorrect PIN a certain number of times before you’re denied pairing for a period of time.

Also: The new Apple TV 4K is always listening for ‘Hey Siri’

A vulnerability in this defense mechanism can allow an attacker within Bluetooth range of, or on the same network as, your device to use a brute-force attack, bypassing the mechanism that limits the number of incorrect PIN attempts, and eventually gain access to your device. There are only so many PIN combinations.

According to Apple, "a logic issue was addressed with improved state management" to fix this problem.