AirPlay Bug Exposes Millions of Devices to Wi-Fi Hacking

A newly discovered set of security vulnerabilities, dubbed “AirBorne,” has put millions of AirPlay-enabled devices at risk of being hacked over Wi-Fi.

These flaws affect not only Apple’s own products but also a vast array of third-party smart devices, including TVs, speakers, set-top boxes, and even vehicle infotainment systems.

AirPlay is Apple’s wireless technology that lets users stream content from iPhones, iPads, and Macs to other devices on the same network. But researchers at cybersecurity firm Oligo uncovered a critical issue: the same always-on convenience can be exploited by hackers connected to the same Wi-Fi.

The researchers found that attackers could use these flaws to run unauthorized code on vulnerable devices, potentially spreading malware across the network.

Third-Party Devices at Highest Risk

While Apple has patched the AirBorne vulnerabilities in its own products through recent updates, the bigger issue lies with third-party devices that rely on Apple’s AirPlay software development kit (SDK). These devices include popular smart TVs, sound systems, and other connected home gadgets. Many of these products do not receive regular security updates, making them long-term targets for attackers.

The danger is heightened because some of these devices incorporate microphones. If compromised, they could theoretically be turned into surveillance tools.

Additionally, once a device is hijacked, it could serve as a foothold for attackers to access other systems on the same network, whether in a home, office, or public space like a café or airport lounge.

Another challenge is that manufacturers can integrate AirPlay support without needing to notify Apple or become certified. This means many devices using the SDK may not appear on Apple’s radar, and users may not realize their gear even uses AirPlay — or that it needs to be updated.

CarPlay Affected, but with Limited Risk

The vulnerabilities also impact CarPlay, Apple’s in-car system that connects phones to dashboard displays. However, the risk here is significantly lower. For an attack to work, a hacker would need to pair their device to the car via Bluetooth or USB, limiting the practical threat.

Nonetheless, the broader implications of the AirBorne flaws highlight the ongoing risks of internet-connected devices, especially those that are rarely updated. Apple has developed patches for third-party manufacturers, but it’s up to vendors and users to implement them.

What Consumers Should Do

To reduce risk, users should immediately check for firmware updates on any AirPlay-enabled device — not just Apple-branded ones. It’s also important to use strong, unique passwords and be cautious when joining public Wi-Fi networks.

Keeping your devices updated remains one of the simplest and most effective ways to protect against cyber threats.