Apple has confirmed, via The Washington Post, that it has in fact issued a server-side fix for an iPhone 6s bug that enabled access to a device’s photos and contacts without the need to verify one’s identity either via a passcode or Touch ID.
Read more here:: Boy Genius Report