AirBorne: How a Zero-Click Bug Threatens Millions of Apple and Third-Party Devices

Daily Security Review

In this episode, we dive deep into AirBorne — a critical set of vulnerabilities in Apple’s AirPlay protocol and SDK, recently uncovered by security researchers at Oligo. These flaws enable zero-click, wormable remote code execution (RCE) attacks across iPhones, Macs, Apple TVs, CarPlay systems, and millions of third-party devices. Even more alarming: attackers don’t need physical access or user interaction. Just a shared network.

We break down how vulnerabilities like CVE-2025-24252 and CVE-2025-24132 open the door for malware to silently hop from one device to another, the risk of eavesdropping and data theft via CarPlay, and why third-party device patching could take years — if it happens at all.

From local file reads to MITM attacks, join us as we explore how these AirPlay flaws became one of the most significant Apple security stories of the year, what Apple has done so far, and what users and enterprises must do to stay protected.