60
60
Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks
Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.
Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.
82
60
60
CISA Adds One Known Exploited Vulnerability to Catalognew
CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.
CISA added CVE-2026-58704, an improper authorization vulnerability in Google Pixel devices, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV-listed vulnerabilities on exposed assets. CISA urges all organizations to prioritize patching KEV entries.
72
Google fixed an actively exploited zero
60
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero
60
Google Warns of Pixel Firmware Security Flaw Exploited as Zero
60
60
60
Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
60
60
60
50
60
Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh servers
60
50
50
60
Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
60
60
60
45
55% Actively Exploited Zero-Day Flaws In 2022 Are Variants Of Previous Bugs
60
Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.
62
60
60
CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog
60
60
60
60
60
Google Patches New Android Kernel Vulnerability Exploited in the Wild
60
It’s a hot 0-day summer for Apple, Google, and Microsoft security fixes
60
60
60