Apple Bluetooth/AirPlay Pairing Vulnerabilities Patched Across Apple Platforms (CVE-2026-113968, CVE-2026-113969, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5738 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Node.js/Bun Runtime Segfault Consistent with Brotli Decoder Exploitation (CVE-2026-111497 Node2Shell)

Detects a Node.js or Bun process terminating with SIGSEGV (signal 11, exit code 139) on Linux hosts. Failed Node2Shell (CVE-2026-111497, Brotli out-of-bounds write, CWE-787) exploitation attempts crash the target process; ELLIO honeypots observed attempts against Node.js 24.22.0. CVE-2026-111497 is in CISA KEV. A crash is also a signal of probing that did not yet yield code execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1203
• Data sources: linux_audit (auditd ANOM_ABEND), linux syslog kernel segfault
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype=linux_audit type=ANOM_ABEND sig=11 (comm=node OR comm=bun OR exe="*/node" OR exe="*/bun") earliest=-24h | eval cve="CVE-2026-111497", campaign="Node2Shell" | stats count AS crashes min(_time) AS first_seen max(_time) AS last_seen values(exe) AS exe values(cve) AS cve by host comm | convert ctime(first_seen) ctime(last_seen) | sort - crashes

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "kernel"
| where SyslogMessage has "segfault"
| where SyslogMessage matches regex @"\b(node|bun)\[\d+\]"
| extend CVE = "CVE-2026-111497", Campaign = "Node2Shell"
| summarize Crashes = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, CVE, Campaign
| order by Crashes desc

Sigma

title: Node.js/Bun Runtime Segfault Consistent with Brotli Decoder Exploitation (CVE-2026-111497 Node2Shell)
id: 3b7e1c52-8a14-4d6f-9e21-5738a0000001
status: experimental
description: Detects a Node.js or Bun process aborting with SIGSEGV, consistent with failed Brotli decoder out-of-bounds write exploitation (CVE-2026-111497, Node2Shell)
references:
    - https://support.apple.com/en-us/149715
    - https://www.securityweek.com/bluetooth-airplay-pairing-vulnerabilities-patched-across-apple-platforms/
    - https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - cve.2026.111497
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'ANOM_ABEND'
        sig: '11'
        comm:
            - 'node'
            - 'bun'
    condition: selection
falsepositives:
    - Native add-on bugs or memory faults in legitimate Node.js applications
    - Out-of-memory or developer debugging crashes on build servers
level: medium

Known false positives:

• Native add-on bugs or memory faults in legitimate Node.js applications
• Out-of-memory or developer debugging crashes on build servers

Tuning notes: Requires auditd ANOM_ABEND events (index=linux sourcetype=linux_audit); adjust index to your environment. Restrict to internet-facing Node.js/Bun hosts, correlate with inbound requests carrying Content-Encoding: br, and suppress known-buggy internal apps. Alert on any crash for hosts running Node.js prior to 22.23.4, 24.22.1 or 26.12.1.

• 🔒 Bluetooth Pairing Completed Without User Interaction Evidence (CVE-2026-113964, CVE-2026-113965) · unlock with TL Creds
• 🔒 Apple Pairing Daemon Crash Burst Consistent with Bluetooth Use-After-Free (CVE-2026-113970) · unlock with TL Creds
• 🔒 Containerized Node.js/Bun Crash Loop with Exit Code 139 (CVE-2026-111497 Brotli Decoder) · unlock with TL Creds
• 🔒 Node.js or Bun Process Spawning a Shell (Post-Exploitation after CVE-2026-111497) · unlock with TL Creds
• 🔒 Node.js or Bun Reading Sensitive Credential Files (Post-Exploitation Collection after CVE-2026-111497) · unlock with TL Creds
• 🔒 Brotli-Encoded Chunked HTTP Request Body Consistent with Node2Shell Delivery (CVE-2026-111497) · unlock with TL Creds
• 🔒 Apple Bluetooth/AirPlay Pairing-Code Attempt Burst (CVE-2026-113964, CVE-2026-113968, CVE-2026-113969) · unlock with TL Creds
• 🔒 AirPlay Pair-Setup/Pair-Verify Flood or Sweep from a Single Network Host (CVE-2026-113969) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5738.

Technical analysis

Apple released iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1 on 2026-11-09 (advisories HT149715, 149716, 149718). Per SecurityWeek and the Apple advisory, five flaws concern pairing: CVE-2026-113968 (AirPlay) lets a nearby Bluetooth attacker bypass pairing-code attempt limits (fixed with better state handling); CVE-2026-113969 (rapportd) lets a network-adjacent attacker bypass AirPlay pairing-code attempt limits; CVE-2026-113964 (CoreUtils) lets a nearby Bluetooth attacker bypass the pairing-code rate limit and pair without user interaction; CVE-2026-113965 (CoreUtils) lets a malicious Bluetooth device pair without user interaction (fixed with additional checks); and CVE-2026-113970 (Bluetooth) is a use-after-free that lets a nearby Bluetooth attacker corrupt process memory.

Other fixes: CVE-2026-113961 and CVE-2026-113960 (Messages) allowed a remote attacker to join an iMessage group chat and receive its messages, and let users added to a group read earlier messages; CVE-2026-113963 (App Intents) is an authorization state-handling flaw that could let an app access sensitive user data (credited to Laszlo Varady; iOS/iPadOS, watchOS and visionOS 27.2.1); CVE-2026-113971 (AirPlay lock screen) allowed an attacker with physical access to pair a device with an AirPlay receiver from the lock screen (iOS/iPadOS 18.7.12 only; iPhone XS, XS Max, XR and 7th-gen iPad). Apple credits itself for five issues; an anonymous researcher is credited for CVE-2026-113964 and both Messages bugs.

CVE-2026-111497 (Brotli, 'Node2Shell', also HTTP2Shell/Broccoli2Shell) is an out-of-bounds write in Google's Brotli decoder (CWE-787, with unchecked return value CWE-252): a crafted stream drives the streaming decoder into an invalid block-switch state that reports 'need more input' instead of a format error, so decoding continues past an eight-byte internal buffer. Apple's advisory describes it as crafted input causing memory corruption. Brotli 1.0.3 through 1.2.0 are affected (fixed in 1.0.10, 1.1.1, 1.2.1). CISA added it to KEV on 2026-10-27 (federal deadline 2026-11-10). ELLIO and Previdian honeypots recorded exploitation attempts against Node.js 24.22.0; ELLIO found the attacker's final stage produced no shell in 50 tests, while public PoC delivery code exists and failed attempts can crash the target process. Sources report no indication of attacks against Apple products.

None of Apple's advisories mention exploitation in the wild for the Apple-specific flaws; no CVSS scores, PoC or attribution are published for them. The practical risk is proximity-based: an attacker within Bluetooth range or on the same network could pair with a device without user interaction. Severity MEDIUM is the analyst's assessment, not source-stated. Note: per-CVE details for Apple flaws are limited to the SecurityWeek article and the HT149715 advisory; the 26.x/18.x/watchOS/macOS advisories were not independently parsed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Credential Access

T1110 Brute Force

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• Apple advisories HT149715 (iOS/iPadOS 27.2.1), HT149716 (iOS/iPadOS 26.7.3), HT149718 (macOS Golden Gate 27.2.1)
• Microsoft .NET 8.0.33, 9.0.22, 10.0.14; Istio 1.31.2 or 1.30.6

Immediate actions

• Update to iOS/iPadOS 27.2.1, 26.7.3 or 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 or Sequoia 15.8.3; watchOS 27.2.1 or 26.6.1; visionOS 27.2.1
• Update Brotli to 1.0.10, 1.1.1 or 1.2.1, Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, Python brotli to 1.2.1 and brotlicffi to 1.2.1.0 where used
• Restart patched processes and rebuild and redeploy container images that bundle Brotli

Workarounds

• Turn off Bluetooth and AirPlay in untrusted environments until updated
• Block Brotli-compressed requests at the proxy or firewall, or disable Brotli decoding, if Brotli patching is not immediately possible

Longer-term hardening

• Track Apple security releases (support.apple.com/en-us/100100) and enforce MDM-managed OS update compliance
• Inventory software that bundles Brotli decoders, including Node.js, Bun, Envoy, Istio, .NET, PAN-OS and VMware SDDC Manager

Affected and fixed versions

• Apple — iOS and iPadOS
  Vulnerable versions: Prior to 27.2.1; Prior to 26.7.3; Prior to 18.7.12
  Fixed in: 27.2.1; 26.7.3; 18.7.12
• Apple — macOS
  Vulnerable versions: Golden Gate prior to 27.2.1; Tahoe prior to 26.7.3; Sequoia prior to 15.8.3
  Fixed in: 27.2.1; 26.7.3; 15.8.3
• Apple — watchOS
  Vulnerable versions: Prior to 27.2.1; Prior to 26.6.1
  Fixed in: 27.2.1; 26.6.1
• Apple — visionOS
  Vulnerable versions: Prior to 27.2.1
  Fixed in: 27.2.1
• Google — Brotli (CVE-2026-111497)
  Vulnerable versions: 1.0.3 through 1.2.0
  Fixed in: 1.0.10; 1.1.1; 1.2.1

Timeline

• 2026-10-21 Node.js and Google release fixes for the Brotli decoder out-of-bounds write (CVE-2026-111497)
• 2026-10-25 Microsoft discloses .NET exposure to CVE-2026-111497 and ships an out-of-band update; ELLIO sensors see a public tool sending Brotli-compressed data to find hosts that process it
• 2026-10-26 ELLIO honeypot records a malicious request targeting Node.js 24.22.0 on x86-64; SAFE Security publishes its technical write-up
• 2026-10-27 CISA adds CVE-2026-111497 to KEV (federal deadline 2026-11-10); Previdian logs a confirmed exploitation attempt from a US-based IP; Broadcom warns of VMware SDDC Manager exposure
• 2026-11-09 Apple releases iOS/iPadOS 27.2.1, 26.7.3, 18.7.12, macOS 27.2.1, 26.7.3, 15.8.3, watchOS 27.2.1, 26.6.1 and visionOS 27.2.1 fixing 10 CVEs including the Bluetooth/AirPlay pairing flaws and Brotli
• 2026-11-10 CISA BOD 26-04 remediation deadline for CVE-2026-111497 for federal civilian agencies
• 2026-11-11 SecurityWeek reports the Apple patches; Apple advisories note no exploitation in the wild for the Apple-specific flaws

Sources cited

• Apple security releases index Apple · Advisory · 2026-11-09
• Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 Apple · Vendor report · 2026-11-09
• Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 Apple · Vendor report · 2026-11-09
• Apple: About the security content of macOS Golden Gate 27.2.1 Apple · Vendor report · 2026-11-09
• SAFE Security: CVE-2026-111497 Inside Node2Shell and the Brotli Decoder Flaw safe.security · Research · 2026-10-26
• SonicWall: Node2Shell Node.js Brotli Decoder Out-of-Bounds Write RCE sonicwall.com · Research
• SecurityWeek: Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms SecurityWeek · News · 2026-11-11
• SecurityWeek: CISA warns of Node2Shell exploitation as honeypots log attack attempts SecurityWeek · News · 2026-10-28
• BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw BleepingComputer · News · 2026-10-28

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Previous and next in vulnerability

• Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746 Previous report
• Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network Next report