AirPlay Zero-Click RCE Vulnerability Enables Remote Device Takeover via Wi-Fi

A critical vulnerability in Apple’s AirPlay protocol, dubbed AirBorne, has exposed over 2.35 billion active Apple devices and tens of millions of third-party gadgets to remote code execution (RCE) attacks requiring no user interaction. Researchers at Oligo Security discovered that the flaw allows attackers on the same Wi-Fi network to hijack devices ranging from Macs and iPhones to CarPlay-enabled vehicles and smart speakers. The Airborne vulnerabilities stem from flaws in Apple’s AirPlay protocol and its Software Development Kit (SDK), which third-party manufacturers use to integrate AirPlay compatibility. As Apple’s ecosystem expands- 2.35 billion active devices as of January 2025- and third-party integrations proliferate, coordinated disclosure and rapid patching are critical. Macs and iOS devices with AirPlay receiver enabled (default: “Current User”) are vulnerable to zero-click attacks if paired with CVE-2025-24206.

This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Apr 2025 14:15:09 +0000

Cyber News related to AirPlay Zero-Click RCE Vulnerability Enables Remote Device Takeover via Wi-Fi

Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks - According to cybersecurity company Oligo Security security researchers who discovered and reported the flaws, they can be exploited in zero-click and one-click RCE attacks, man-in-the-middle (MITM) attacks, and denial of service (DoS) attacks, as ...
1 hour ago Bleepingcomputer.com CVE-2025-24206

AirPlay Zero-Click RCE Vulnerability Enables Remote Device Takeover via Wi-Fi - A critical vulnerability in Apple’s AirPlay protocol, dubbed AirBorne, has exposed over 2.35 billion active Apple devices and tens of millions of third-party gadgets to remote code execution (RCE) attacks requiring no user interaction. Researchers ...
4 hours ago Cybersecuritynews.com CVE-2025-24206

Zero Trust 2025 - Emerging Trends Every Security Leader Needs to Know - Forward-thinking organizations are embedding Zero Trust principles into broader business strategies rather than treating them as isolated security initiatives. Security leaders must champion this integrated approach to Zero Trust implementation to ...
2 weeks ago Cybersecuritynews.com

Zero-Trust Architecture in Modern Cybersecurity - Clearly, organizations need more robust cybersecurity protections in place, which is leading many to adopt a zero-trust architecture approach. Zero-trust flips conventional security on its head by shifting from an implicit trust model to one where ...
1 year ago Feeds.dzone.com

Zero Trust Security Framework: Implementing Trust in Business - The Zero Trust security framework is an effective approach to enhancing security by challenging traditional notions of trust. Zero Trust Security represents a significant shift in the cybersecurity approach, challenging the conventional concept of ...
1 year ago Securityzap.com

Check Point released hotfix for actively exploited VPN zero-day - MUST READ. Check Point released hotfix for actively exploited VPN zero-day. Microsoft Patch Tuesday security updates for May 2024 fixes 2 actively exploited zero-days. Critical Fortinet's FortiClient EMS flaw actively exploited in the wild. Apple ...
10 months ago Securityaffairs.com CVE-2024-23222 CVE-2023-22515 CVE-2023-40044 CVE-2023-20109

Implementing Zero Trust and Mitigating Risk: ISC2 Courses to Support Your Development - PRESS RELEASE. Zero trust security is a proactive and robust approach to cybersecurity that addresses modern threats by continuously verifying and monitoring all network activities. While its implementation can be complex and resource-intensive, the ...
9 months ago Darkreading.com

Zero Trust Architecture - A Step-by-Step Guide for CISOs - With thoughtful leadership and strategic implementation, Zero Trust architecture can transform your organization’s security posture, providing protection that aligns with today’s distributed work environments and evolving threat ...
1 week ago Cybersecuritynews.com

Days After Google, Apple Reveals Exploited Zero-Day in Browser Engine - Apple has patched an actively exploited zero-day bug in its WebKit browser engine for Safari. Actively Exploited Apple yesterday described the vulnerability as something an attacker could exploit to execute arbitrary code on affected systems. ...
1 year ago Darkreading.com CVE-2024-23222

Apple fixes Safari WebKit zero-day flaw exploited at Pwn2Own - Apple has released security updates to fix a zero-day vulnerability in the Safari web browser exploited during this year's Pwn2Own Vancouver hacking competition. The company addressed the security flaw on systems running macOS Monterey and macOS ...
11 months ago Bleepingcomputer.com CVE-2024-27834

The Role of Zero-Knowledge Proofs in LLM Chains - In today's digital age, data privacy has become a paramount concern for individuals and organizations alike. With the increasing amount of personal and sensitive information being stored and transmitted online, there is a growing need for robust ...
1 year ago Feeds.dzone.com

December Android updates fix critical zero-click RCE flaw - Google announced today that the December 2023 Android security updates tackle 85 vulnerabilities, including a critical severity zero-click remote code execution bug. Tracked as CVE-2023-40088, the zero-click RCE bug was found in Android's System ...
1 year ago Bleepingcomputer.com CVE-2023-40088

The 7 Core Pillars of a Zero-Trust Architecture - The zero-trust framework is gaining traction in the enterprise due to its security benefits. Organizations are increasingly adopting a zero-trust model in their security programs, replacing the traditional perimeter-based security model. The ...
10 months ago Techtarget.com

Integrate Modern Strategies for Zero Trust with Identity & Access Management (IAM) - The implementation of Zero Trust in identity and access management requires careful consideration of several critical elements that work together to create a comprehensive security framework. Leaders who approach Zero Trust as a strategic business ...
2 weeks ago Cybersecuritynews.com

Apple fixes two new iOS zero-days in emergency updates - Apple released emergency security updates to fix two zero-day vulnerabilities exploited in attacks and impacting iPhone, iPad, and Mac devices, reaching 20 zero-days patched since the start of the year. "Apple is aware of a report that this issue may ...
1 year ago Bleepingcomputer.com CVE-2023-42916 CVE-2023-42917

Why a Zero Trust Security Policy Matters and Steps to Implementation - Adaptability: In a world where business operations span across multiple environments, from on-premises data centers to cloud-based applications, a flexible security approach is essential. Zero trust provides precisely that, ensuring that your ...
1 year ago Securityboulevard.com

Navigating the Future: Zero Trust and SSE in Cybersecurity Leadership Strategies - This article delves into two potent concepts shaping the future of information security: Zero Trust and Security Service Edge. In this new reality, organizations require adaptable security measures to keep pace with the changing tides. At its ...
11 months ago Cybersecurity-insiders.com

Identity Verification and Access Control with No Trust Assumed - Zero trust is a security model that is becoming increasingly important in the world of cybersecurity. In 2023, we will see more vendors offering complete zero trust products and services, and more businesses attempting to implement it. Zero trust is ...
2 years ago Securityweek.com

Apple backports fix for RTKit iOS zero-day to older iPhones - Apple has backported security patches released in March to older iPhones and iPads, fixing an iOS Kernel zero-day tagged as exploited in attacks. The flaw is a memory corruption issue in Apple's RTKit real-time operating system that enables attackers ...
11 months ago Bleepingcomputer.com CVE-2024-23296

10 of the biggest zero-day attacks of 2023 - Here are 10 of the biggest zero-day attacks of 2023 in chronological order. Zero-day attacks started strong in 2023 with CVE-2023-0669, a pre-authentication command injection vulnerability in Fortra's GoAnywhere managed file transfer product. ...
1 year ago Techtarget.com CVE-2023-0669 CVE-2023-34362 CVE-2023-36884 CVE-2023-4863 CVE-2023-41992 CVE-2023-41991 CVE-2023-41993 CVE-2023-22515

Ivanti Connect Secure zero-days now under mass exploitation - Two zero-day vulnerabilities affecting Ivanti's Connect Secure VPN and Policy Secure network access control appliances are now under mass exploitation. As discovered by threat intelligence company Volexity, which also first spotted the zero-days ...
1 year ago Bleepingcomputer.com CVE-2023-46805 CVE-2024-21887 CVE-2021-22893

Cisco Secure Access Extends SSE With Mobile Zero Trust - Earlier this year, we introduced Cisco Secure Access, a security service edge solution that combines a secure web gateway, cloud access security broker, firewall-as-a-service, zero trust access and more, to help organizations address this challenge ...
1 year ago Feedpress.me

Samsung Galaxy S23 hacked two more times at Pwn2Own Toronto - Security researchers hacked the Samsung Galaxy S23 smartphone two more times on the second day of the Pwn2Own 2023 hacking competition in Toronto, Canada. The contestants also demoed zero-day bugs in printers, routers, smart speakers, surveillance ...
1 year ago Bleepingcomputer.com

Google says spyware vendors behind most zero-days it discovers - Commercial spyware vendors were behind 80% of the zero-day vulnerabilities Google's Threat Analysis Group discovered in 2023 and used to spy on devices worldwide. Zero-day vulnerabilities are security flaws the vendors of impacted software do not ...
1 year ago Bleepingcomputer.com

Cisco patches IOS XE zero-days used to hack over 50,000 devices - Cisco has addressed the two vulnerabilities that hackers exploited to compromise tens of thousands of IOS XE devices over the past week. The free software release comes after a threat actor leveraged the security issues as zero-days to compromise and ...
1 year ago Bleepingcomputer.com CVE-2023-20198