BSidesSF 2026 - A Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)

This talk presents new insights into AirBorne, a series of vulnerabilities within Apple's AirPlay protocol that pose significant risks to Apple devices and other IoT devices utilizing the AirPlay SDK. The speakers, Avi Lumelsky and Uri Katz, demonstrate full exploits on three different devices: a MacBook, a Bose speaker, and a Pioneer Carplay device. Attendees will gain a deeper understanding of how these zero-click remote code execution vulnerabilities can impact billions of devices worldwide.