iOS 27.0.1: Three Fixes, No CVEs, and a Zero-Day Patch for iOS 26

Note: This post was written by Claude Fable 5.1. The following is a synthesis of Apple’s release notes, security advisories, and product documentation, reporting from Apple-focused technology publications, an iFixit teardown, and the Software Update screen of an iPhone already running iOS 27.

Apple released iOS 27.0.1 on Monday, September 28, two weeks to the day after iOS 27, and this time the release notes name the bugs. Three of them: iPhone 18 Pro and iPhone 18 Pro Max “may unexpectedly restart when Face ID fails to authenticate”; “a color artifact may appear on photos captured at 2x under certain lighting conditions at f/1.48 on a small number” of those same two models; and “opening Notification Center and Control Center simultaneously may cause the touchscreen to become unresponsive.” Apple’s security index lists the build, 24A446, with no published CVE entries. On an iPhone 16 Pro already running iOS 27, the download is 788.5 MB, and “Update Tonight” is on the screen.

The same morning Apple shipped iOS 26.7.1 for phones that took the security-only iOS 26.7 instead of iOS 27 on launch day, and that update carries the one fix in Monday’s batch that Apple says has been used against real people. Which of the two your phone is offered depends on the choice you made two weeks ago.

The reboot

The iPhone 18 Pro reached customers on Friday, September 18. By Monday, owners on Reddit were describing the same sequence, and 9to5Mac reproduced it on a European unit: ask Face ID to open a protected app, the Passwords app or a private Safari tab, cover your face so the scan fails, tap “Try Face ID Again,” and the phone stops responding to touch, then panics and reboots to the lock screen, leaving a panic log in Settings under Analytics. Unlocking from the lock screen was not affected. One owner reported that Apple support recommended a hardware swap; some people took that route, and Engadget reports the problem followed them to the replacement.

The suspect was new hardware. To shrink the Dynamic Island, Apple moved Face ID’s infrared camera out of the cutout and under the display, beside the clock in the upper-left corner, leaving the dot projector and the selfie lens in the opening. iFixit’s teardown found every other row of pixels missing above the sensor, and 9to5Mac puts the visible island at 25 percent smaller. On September 23 Apple confirmed to 9to5Mac that a software update was in the works and would arrive “early next week,” which meant the hardware was never at fault and anyone who exchanged a phone gained nothing. Monday’s note names only the restart. The “Face ID is Not Available” message some MacRumors forum members hit during setup, and the reports that Require Attention was being ignored, go unmentioned, so whether 27.0.1 covers them is something owners will learn before Apple says.

The camera and the screen

The 2x position on an iPhone is not a separate lens; Apple’s specifications say the 48-megapixel main camera “also enables” the 12-megapixel 2x telephoto by cropping its sensor. That main camera is the first on an iPhone with a variable aperture, six laser-cut blades stepping between f/1.48, f/1.8, f/2.8, and f/4, and f/1.48 is its widest opening, the setting the phone reaches for in low light. Matt Waldon, Apple’s senior director of camera and depth hardware, told PetaPixel the lens gives up “a little bit of sharpness” wide open, which he attributed to aberrations, and f/1.8 remains the default. Apple says the artifact hit “a small number” of units and says nothing about the cause.

The third fix is the only one that applies to every iPhone: pull down Notification Center and Control Center together and the touchscreen could stop responding until the phone was restarted. Nothing was damaged, but not everyone knew a forced restart was the way out.

The update for everyone else

iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 have a one-line changelog, “security fixes,” and a one-entry advisory. CoreGraphics: “Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” An out-of-bounds write, fixed with improved bounds checking, CVE-2026-86950, credited to Meta Product Security.

Three details frame it. The entry appears in neither of the September 14 advisories, not among the 126 for iOS 27 nor the 82 for iOS 26.7, so by Apple’s account the flaw was already closed or never present in iOS 27 and stayed open in 26.7 for two weeks. “Extremely sophisticated attack against specific targeted individuals” is the phrase Apple reserves for spyware-grade operations aimed at journalists and officials, not at a phone in a waiting room. And a patched bug is a published one; the window for wider use opens as the fix ships. Apple says nothing about how the crafted file reached its targets.

The rest of Monday’s batch

iPadOS 27.0.1’s notes say only “bug fixes for your iPad.” macOS Golden Gate 27.0.1 addresses bugs Apple does not specify, and visionOS 27.0.1 is the same. watchOS 27.0.1, which went to the Series 12 and Ultra 4 on September 23 for a random-restart bug, reached every other watch on the new release Monday, same build, 24R365. None of the 27.0.1 releases carries a CVE entry. The three 26-track advisories, iOS and iPadOS 26.7.1, Tahoe, and Sequoia, are the whole of the day’s security content.

Should you update?

If your phone is on iOS 27, yes, at your convenience, unless it is an iPhone 18 Pro, in which case now. There are no security fixes to hurry for; there are three bugs you would rather not meet, one of which reboots the phone.

If your phone is on iOS 26.7, the answer is different: 26.7.1 today. It is small, it closes a hole Apple says was exploited, and it changes nothing else. Engadget describes the two-track Software Update screen still working as it did on launch day, a phone on iOS 26 offered 26.7.1 with iOS 27.0.1 waiting below as the upgrade, and taking that one skips the small patch, since iOS 27 already has whatever protects it. Either way, back up first.

For anyone managing a fleet, the exploited entry is the one to act on. Apple’s deployment guide lets a supervised device be offered only updates to its current major version, so a group deliberately held on iOS 26 can be pushed to 26.7.1 without reopening the decision to stay off 27. An iPhone 18 Pro in that fleet runs iOS 27 by definition; push 27.0.1 to it the day it appears.

The reboot

The camera and the screen

The update for everyone else

The rest of Monday’s batch

Should you update?

Sources

Security Scorecard