Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Apple patched 10 vulnerabilities across its platforms, including Bluetooth and AirPlay pairing flaws.
Apple has released security updates for iOS, iPadOS, macOS, watchOS, and visionOS to address 10 vulnerabilities. Five of these flaws are related to Bluetooth and AirPlay pairing, with some allowing attackers in Bluetooth range to bypass pairing code limits or establish connections without user interaction. Additionally, two iMessage vulnerabilities and a Brotli bug, known as Node2Shell and previously targeted by threat actors, were patched.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apple?
Get an email when a new story names Apple, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonApple released critical security updates addressing 10 vulnerabilities across its entire product ecosystem, including five Bluetooth and AirPlay pairing flaws that could allow attackers within Bluetooth range to bypass pairing code limits or establish unauthorized connections without any user interaction. This class of vulnerability is particularly dangerous because it requires no authentication from the victim and can be exploited silently in public spaces such as airports, cafes, or offices. The inclusion of a known-exploited Brotli bug (Node2Shell) further underscores that some of these flaws were actively targeted in the wild before the patch was available. Organizations and individuals who delay applying these updates remain exposed to silent device compromise simply by being in physical proximity to an attacker. Timely patching across all supported platforms — including wearables and mixed-reality devices — is essential as the attack surface for personal device ecosystems continues to grow.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-113968
- cve — CVE-2026-113969
- cve — CVE-2026-113964
- cve — CVE-2026-113965
- cve — CVE-2026-113970
- cve — CVE-2026-113961
- cve — CVE-2026-113960
- cve — CVE-2026-111497
- cve — CVE-2026-113963
- cve — CVE-2026-113971