AirPlay Flaws Expose Apple Devices to Zero-Click Wi-Fi Attacks

Cybersecurity firm Oligo has identified a series of critical vulnerabilities in Apple’s AirPlay protocol, collectively named “AirBorne.” These flaws enable attackers on the same Wi-Fi network to perform zero-click remote code execution (RCE) attacks, potentially taking control of AirPlay-enabled devices without any user interaction. The vulnerabilities affect a wide range of devices, including iPhones, iPads, Macs, and third-party products like smart TVs and speakers. Notably, some of these flaws are “wormable,” meaning they can propagate malware across devices on the same network. Apple has released patches addressing these issues in updates for iOS 18.4, macOS Sequoia 15.4, and other platforms. However, many third-party devices remain vulnerable due to delayed or absent updates. Users are advised to update their devices promptly, disable AirPlay when not in use, and restrict AirPlay access to trusted networks to mitigate potential risks.