https://9to5mac.com/2017/12/07/homekit-vulnerability/

Oops. Glad it can be mostly fixed server side, and ultimately is being fixed fast without needing to swap any hardware. It helps that they set such a high security bar in the first place compared to most other home automation setups even if it hindered the initial HomeKit adoption.