Apple patches Bluetooth and AirPlay pairing flaws across platforms
Ten fixes cover current and older Apple releases; advisories do not report exploitation of the Apple issues.
Stories per day · 30 days
2 RSS
Relatedimessage5airplay4alpine4apple4ilx-f5114ios4pwn2own4zero-day4buffer-overflow3ipados3ubuntu3brotli2linux-kernel2a2dp1bluez1consumer-devices1dataset1deep-learning1
24 stories, newest first · one card per story
Stories tagged #bluetooth
Apple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
Apple patches iMessage group-chat flaws and Bluetooth pairing bugs
iOS and iPadOS 27.2.1 also fix Brotli CVE-2026-111497, which CISA added to the Known Exploited Vulnerabilities catalog on October 27.
Apple iOS 27.2.1 fixes nine flaws in iMessage, Bluetooth, and AirPlay
The same release covers iPadOS 27.2.1; Apple does not say any of the nine flaws are exploited.
Apple patches nine iOS 27.2.1 and iPadOS 27.2.1 flaws, none exploited
Fixes include Bluetooth pairing-limit bypasses, AirPlay flaws, and iMessage group access; Apple reports no real-world use.
Ubuntu kernel update fixes Xen netback DoS and Bluetooth flaw
A guest can exhaust backend memory, and a local user may crash the system or possibly run code.
arXiv releases BLE device fingerprinting dataset and testbed
Large-scale raw IQ dataset from 31 Bluetooth Low Energy devices across varied environments plus evaluation of domain-robust radio-frequency fingerprinting models.
Alpine iLX-F511 vCard parser 0-day allows Bluetooth RCE
A network-adjacent attacker needs the unit to connect to a malicious Bluetooth device; ZDI rates it CVSS 8.0.
USN-8908-2: BlueZ regression
Ubuntu's USN-8908-2 fixes a BlueZ A2DP regression that stopped Bluetooth audio devices from reconnecting automatically.
USN-8908-1: BlueZ vulnerabilities
Ubuntu patched BlueZ flaws, including an A2DP stack overflow and an out-of-bounds memory read.
Windows 11 KB5124010 update released with 46 changes and fixes
Microsoft shipped optional Windows 11 preview KB5124010, a non-security update with 46 quality fixes and feature changes.
2
Some cheap smart glasses are a security disaster
NSB Cyber and Abstract Shield found a dozen flaws in cheap smart glasses, including unauthenticated Bluetooth pairing letting attackers hijack cameras and intercept data.
1
The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices
Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.
Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone
Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing via Airoha SDK flaw CVE-2025-20701, enabling audio hijack and microphone capture.
Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone
CERT/CC disclosed VU#859658: Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing, letting nearby attackers hijack audio and microphone.
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.
VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth
Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.
3
Hack One Robot, Reach the Next: Unitree G1 Security Flaws
Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.
5
ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.
6
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.
3
New surveillance tech links your phone to your license plate
Researchers show roadside cameras plus Bluetooth signals can link phones to license plates, enabling richer tracking.