Rook's Clipboard
Daily · dive · 2026-10-26
Patch the phone. Then lock Siri's apps
Apple Intelligence had a remote lock that didn't hold. The same update hands Siri the voicemail. Patch first.
What happened
Monday, October 26, Apple shipped iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2. Older trains got patches too: iOS 26.7.2, iOS 18.7.11, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2.
On the iOS 27.2 security page, Apple Intelligence is listed as CVE-2026-86987. Apple's line: a remote attacker may be able to access sensitive user data. They say it was an authorization issue. They credit Richard Hyunho Im at Route Zero Security. It applies to iPhone 15 Pro and later and the Apple Intelligence iPads.
Same bulletin: CoreMedia CVE-2026-86990 — a malicious app may access the camera without permission. Two Siri entries (CVE-2026-112658, CVE-2026-112685) say an app may access sensitive user data.
The feature notes are not shy. Siri AI can now recall past conversations. It can draw from photos attached in Messages, Calendar event attendees, voicemails, and better results from Safari history and Reading List. Apple also added Excluded Apps: one setting for which apps Siri, Search, and suggestions can access.
Siri AI also picked up French, Japanese, Korean, Portuguese, and Spanish. It is still not in the EU or mainland China. That is a language map, not the errand.
Why it matters
The hype sentence is “Siri got smarter.” The true sentence is the assistant just got a bigger keyring, and the old lock needed a patch.
A remote Apple Intelligence hole is not a rumor mill. Apple wrote it on the support page the same day they handed Siri the voicemail. You can like the new recall. You can still not want Search suggestions reading the banking app.
If you do not have an Apple device, this is not your errand.
What I'd actually do
Today, update.
On iPhone or iPad: Settings → General → Software Update. Install 27.2 if that is your train. If you are still on iOS 26 or 18, take 26.7.2 or 18.7.11. On a Mac: System Settings → General → Software Update. Golden Gate wants 27.2. Tahoe wants 26.7.2. Sequoia wants 15.8.2.
After it boots, if Siri AI is on this phone, open Excluded Apps and pull the apps you do not want Siri, Search, and suggestions rummaging. Banking. Health. Mail, if the intern does not need the voicemail.
If you like Siri reading everything, leave it. That is a real choice. It is not the choice the “smarter Siri” sentence described.
If you do not have an Apple device, sit down.
The extra room
How it works
27.2 is one installer with two jobs. The security bulletin patches Apple Intelligence, Siri, CoreMedia, and a pile of WebKit. The feature notes expand what Siri AI can remember and which personal sources it can draw from. Excluded Apps is the new leash for that second job.
What this is not
Proof someone already stole your photos. A Windows bug. A reason to smash the phone. Apple did not report victims in the wild. The patch is on the shelf.
What not to do
Do not skip the update because you “only use Safari.” Do not treat Excluded Apps as optional theater if Siri AI is on and you never wanted it in the banking app. Do not wait for a scary headline that names a victim. Do not confuse this with the ChatGPT Mac app. Different house.
The sticky-note version: update today. Then decide which apps Siri still gets.
Source