Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

, ,

Google released patches in its November 2026 Android security bulletin fixing a critical vulnerability (CVE-2026-58868) affecting Android 14 through 17 that could allow remote code execution without user interaction via a heap buffer overflow. The update also addresses other critical flaws, including a remote denial-of-service issue in Android’s SMS handling, urging users to install the November security patch (2026-11-01 or later) as soon as possible, though no active exploitations have been reported so far.

https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html

CWP2Shell: The Login Page That Never Says No

, ,

VulnCheck disclosed ten critical vulnerabilities in Control Web Panel (CWP), including an unauthenticated remote code execution (CVE-2026-73695) via a module path traversal combined with a missing exit() after a login redirect that allows execution of attacker-controlled PHP modules. This initial foothold lets attackers escalate to root through unauthenticated command injection and SQL injection flaws in the loopback user API, enabling full root access on affected servers; all issues are fixed in CWP 1.29 (October 31, 2026). Given tens of thousands of internet-facing installations expose the vulnerable user panel, operators must upgrade immediately to mitigate high-severity exploit paths actively demonstrated with public exploit tooling.

https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce

What Exploited Vulnerabilities Have in Common: a Data-Driven Analysis of Real-World Attacks

,

Analysis of approximately 383,000 disclosed software vulnerabilities shows that fewer than 0.5% have been exploited in real-world attacks, with threat actors primarily targeting flaws that enable system takeover such as remote code execution, privilege escalation, and authentication bypass. Exploitation occurs rapidly—often within days of disclosure—while patching critical systems can take weeks to months, underscoring the need for defenders to prioritize remediation based on the potential impact and exposure of vulnerabilities, focusing especially on those that allow full control over highly exposed systems. Microsoft’s security tools assist defenders by continuously discovering internet-facing assets, prioritizing vulnerabilities using exposure and exploitability data, and analyzing attack paths to prevent compromise from spreading within environments.

https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/

Prompt Adware: a New AI Security Risk

, , ,

Check Point Research identified “prompt adware,” a new security risk where trusted AI agents’ natural-language instructions are persistently modified to influence their behavior, demonstrated by the Haiou jailbreak bundle that injects advertisements into OpenAI Codex responses. This technique, which manipulates AI prompts and configurations rather than executable code, raises concerns about visibility and control over third-party AI components, potentially enabling covert manipulation or data exfiltration in enterprise environments. Organizations are advised to enhance oversight of AI agents, their prompts, and third-party tools to manage these emerging risks as AI adoption grows.

https://blog.checkpoint.com/security/prompt-adware-how-hidden-ai-instructions-could-create-a-new-enterprise-security-risk/

UEFI Bootkit Infected Fully Patched Windows Machines. Is Microsoft to Blame?

, , ,

The UEFI bootkit BlackX has infected fully patched Windows machines by exploiting a long-standing vulnerability in the Windows boot manager that Microsoft patched in 2022 but has not fully neutralized due to delayed revocation of trust in older vulnerable bootloader certificates. Despite multiple updates, Microsoft requires administrators to manually revoke these certificates—a step often overlooked—which allowed BlackX to bypass Secure Boot protections and run malicious code early in the boot process. This incident highlights challenges in Microsoft’s patch deployment and communication, leaving systems exposed to persistent and stealthy boot-level malware.

https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/

PHP2Shell: What We Know About the Threat Two Weeks Later

, ,

Two critical PHP vulnerabilities known as PHP2Shell, disclosed in late October 2026, could allow remote code execution on about 70% of websites globally, yet mass exploitation reports remain limited. While emergency patches have been released alongside a subsequent fix for a related Brotli library flaw, many servers remain unpatched, and successful attacks—such as those targeting Palo Alto Networks PAN-OS devices—have demonstrated real-world impact. Experts advise urgent patching combined with thorough system audits and using specialized detection tools to identify potential compromises.

https://www.kaspersky.com/blog/php2shell-two-weeks-after-patches/56647/

Cloudflare DDoS Threat Report 2026 Q3: More Swarms, Fewer Giants

,

Cloudflare’s Q3 2026 DDoS Threat Report reveals a shift from reliance on massive single-source attacks toward more frequent, distributed “swarms” of smaller attacks. This trend indicates attackers are increasingly leveraging diverse, often lower-profile botnets to launch DDoS campaigns, complicating detection and mitigation efforts. The report underscores the evolving threat landscape and the need for adaptive DDoS defense strategies.

https://blog.cloudflare.com/ddos-threat-report-2026-q3/

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, Dutch security firm Eye Security remotely pushed over 2 million updates to disable a vulnerable background updater in the abandoned Time4Popcorn app, a Popcorn Time copy, which ran with high privileges and could have allowed attackers to take over millions of Windows and Mac computers. Since no official patch was available, Eye Security registered the app’s abandoned update domains to serve a kill-switch update that stopped and disabled the updater, significantly reducing potential botnet risks; however, users are still advised to uninstall Popcorn Time due to other inherent security issues.

https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

, ,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Broadcom VMware ESX vulnerability (CVE-2026-41709) to its Known Exploited Vulnerabilities catalog after CrowdStrike reported its exploitation by the China-linked threat actor Warp Panda. This zero-day flaw allows attackers with admin access to perform actions without logging, enabling reduced audit trail visibility; Warp Panda has used it to target U.S. legal sector organizations and maintain covert persistence by bypassing detection mechanisms. Agencies are advised to apply available patches by November 11, 2026, to mitigate this active threat.

https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

Chrome Extensions with 13.4 Million Installs Caught Hijacking Searches

, , ,

A campaign involving 319 Chrome extensions with 13.4 million installs has been found hijacking users’ searches by redirecting them through tracking servers to generate ad revenue from Bing and Yahoo. These unlisted extensions, disguised as useful tools and promoted via shady ads, exploit Chrome’s settings to replace default search engines and funnel traffic through operator-controlled proxies, risking redirection to phishing sites or malware. Most identified extensions have been removed from the Chrome Web Store, but new variants continue to appear, prompting users to uninstall suspicious add-ons and run full antivirus scans.

https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

, ,

A critical race condition vulnerability (CVE-2026-98432) in the Linux kernel’s TCP code allows remote attackers to execute commands as root, affecting Ubuntu, Red Hat, and other distributions with a CVSS score of 9.8 assigned by the kernel’s CVE team. While Debian, Oracle Linux, SUSE, and Amazon Linux have released patches, Ubuntu and Red Hat have yet to provide fixed kernels, and the flaw primarily exploits the multipath TCP feature, with recommendations to update to patched kernel versions where available. Anthropic’s AI-generated exploit demonstrates how an attacker can leak kernel memory addresses and gain root access, highlighting the urgency to apply updates once released.

https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

,

Anthropic’s unreleased internal AI model automatically discovered and chained multiple security flaws into working proof-of-concept exploits affecting Chrome, Safari, Android, Windows, and Linux, all of which have since been patched following coordinated disclosure. Notably, the AI combined several distinct vulnerabilities to achieve complex exploits such as running code outside browser sandboxes and obtaining root commands over a network, demonstrating an unprecedented automated capability previously attributed only to specialized human teams. Anthropic emphasizes these findings as a tool to aid defenders and offers vetted security professionals access to its AI models through a Cyber Verification Program.

https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html

PHP2Shell Security Flaws Now Sucessfully Exploited in the Wild

, ,

Two critical PHP vulnerabilities, collectively called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been confirmed to be exploited in the wild, with evidence of successful remote code execution on Apache mod_php running PHP 8.4.26. Security researchers and threat analysts observed active exploitation attempts before and after emergency patches were released on October 21, 2026, prompting advisories for immediate patching and mitigation measures to protect millions of exposed PHP-based web servers.

https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

, ,

A long-running hacking campaign since July 2025 has infected 953 online stores, predominantly running Magento, by injecting scanner-evading malicious JavaScript into CMS blocks to target real shoppers while avoiding detection by security tools. The attackers exploited vulnerabilities such as PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) to gain access, and use multiple rotating domains to host loader scripts that include bot filtering and persistent payload storage. Site owners are urged to audit for suspicious CMS blocks and administrator accounts, apply security patches, and enforce strong passwords to mitigate the threat.

https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html

Reports of PHP Bug Exploitation Attempts Grow as Experts Downplay Viability of Exploits

,

Reports of attempted exploits targeting two recent PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), have surged, with several large companies observing scanning and probe activities linked to botnets like Potassium and Mirai. However, cybersecurity experts emphasize that no successful widespread exploitation has been confirmed, noting that proof-of-concept exploits mostly function only under ideal lab conditions and are impeded by protections such as address space layout randomization (ASLR). Despite the current challenges for attackers, experts warn that evolving exploit techniques could overcome these barriers soon, urging organizations to promptly patch vulnerable PHP systems.

https://therecord.media/php-php2shell-exploitation-attempts-pocs

Scroll to Top