Apple has released a fresh round of updates for iPhone, iPad, Mac, Apple Watch and Vision Pro that includes a fix for CVE-2026-111497, a flaw in Google's Brotli compression library that CISA has listed as exploited in the wild since late October. Hong Kong's HKCERT, which gathered the releases into a single bulletin on November 10, rates the batch Extremely High Risk because of that bug.
Brotli is the compression format browsers and servers use to shrink web traffic, so a flaw in its decoder reaches a long way. We have followed it from the first fixes in the wider Brotli disclosure to its addition to CISA's Known Exploited Vulnerabilities catalog, covered in CISA says hackers now exploit Brotli and Magento flaws. Apple's updates now bring the fix to its own platforms.
Ten fixes, one already under attack
CVE-2026-111497 affects Google Brotli versions 1.0.3 through 1.2.0 and is rated 9.2 (critical) in its NVD record. According to HKCERT's summary, a remote, unauthenticated attacker can use a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.
The exploitation evidence comes from CISA's catalog, not from Apple. HKCERT's bulletin does not say that attacks have targeted Apple devices specifically, and we have seen no such claim. What it does establish is that a bug attackers are already using is now patched on Apple's platforms.
The other nine CVEs fixed in this round are CVE-2026-113960, CVE-2026-113961, CVE-2026-113963, CVE-2026-113964, CVE-2026-113965, CVE-2026-113968, CVE-2026-113969, CVE-2026-113970 and CVE-2026-113971. HKCERT groups their possible impact as denial of service, security restriction bypass, information disclosure and remote code execution, but does not break that down per bug, and no severity scores are published for them in the bulletin. Apple's own security notes carry the per-flaw detail, for example this note and this one, which sit alongside seven further notes for the other platforms.
Update to iOS 27.2.1 or the matching older-branch release
The fixed versions are:
- iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12
- macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3
- watchOS 27.2.1 and watchOS 26.6.1
- visionOS 27.2.1
Install the update for whichever branch your device runs; owners of older iPhones on the 18.x line get the same fix in 18.7.12. Organizations managing Apple fleets should push these through MDM rather than wait for users, given CISA's exploitation finding. Brotli is also embedded in plenty of non-Apple software, so a patched phone does not close the question for servers, proxies and runtimes that bundle their own copy of the library.
Apple's point releases tend to be read as housekeeping. This one carries a fix for a bug attackers are already using, which is reason enough to install it today rather than at the next convenient restart.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.