iOS 27.0.1 is out already - there are no security fixes listed (just the words "this update has no published CVE entries"), but there's an interesting bug patched for iPhone 18 Pro and Pro Max models that "may unexpectedly restart when Face ID fails to authenticate." That's a "fail closed" situation, which beats "fail open" in a case like this, but that could, admittedly with a bit of a stretch and a wry look, be considered a potential DoS (denial of service) vulnerability... ...because one of those people whom you consider a friend-with-a-very-annoying-sense-of-humour could, I suppose, pick up your locked phone and force it to reboot simply by glaring or gurning at it, and thereby quite deliberately forcing it down the code path of a failed Face ID. They could offer the excuse, if confronted, that they had no intention of actually unlocking it, but were "just looking at your cool new phone" to see if they, too, were ready to splash out top money on one for themselves. (It's an interesting question whether deliberately triggering an unlock attempt that shouldn't work could be successfully prosecuted under unauthorised access laws. But even if it couldn't, my opinion is that doing so, even if you can guarantee the unlock will fail, violates the spirit of the law. It also messes with the unwritten social contract not to mess with other people's digital stuff, no matter how harmless or witty you think it might be. If in doubt, leave it out, eh?)