Apple lists iOS 27.2.1 (24B156) software release
The developer listing names build 24B156 and only offers downloads, with no security notes.
Stories per day · 30 days
3 RSS
Relatedandroid4ios4apple3software-release2adobe1adware1app-fingerprinting1app-stores1benchmark1bitdefender1boot-loop1chrome1denial-of-service1encrypted-traffic1evidence-extraction1exploit-kit1fake-app1forensics1
44 stories, newest first · one card per story
Stories tagged #mobile
GhostMap Android flaw lets installed app force a boot loop
Bitdefender’s no-permission demo crashed a Pixel 10 on Android 17; Google closed the report without a patch.
Phone return scams target mobile providers
Scammers send a real phone but use fake return labels to keep the device and leave victims with bills or contracts.
SNEEF framework extracts forensic evidence from mobile SQLite databases
SNEEF achieves an F1 score of 0.967 for evidence entities from SQLite row content.
Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
Google to allow one-tap installs from approved Android stores outside the US
Approved stores get the feature on December 1 for Android 17 QPR2 or later after ongoing malware scans.
MoI-Bench scores mobile image generation and editing gaps
The suite has 64 subtasks and 1,150 samples, with MoI-Eval scoring instruction following, quality and detail preservation.
Authenticator for Android flaw let apps steal work tokens (CVE-2026-80097)
Fixed in version 6.2606.4246; Microsoft says it was not used in attacks and rates exploitation less likely.
1
GUI-JEPA scores mobile GUI actions in latent space without decoding
On AndroidControl it is 2.8–4.0x faster than a fine-tuned Qwen2.5-VL-7B agent while using 6% of the parameters.
Researchers claim iPhone, Signal and iMessage hacks at Hexacon
Calif.io showed the demos in Paris on October 16 and said full details will come later.
Phone scams shift toward texts, voice clones, and QR codes
Consumers reported $470 million lost to text scams in 2024, and CrowdStrike says vishing doubled in early 2026.
Lightroom mobile can open closed eyes with one generative tap
Free users get two tries before a Creative Cloud prompt, and the app can reference other photos of the same person.
MAppPrint: Robust and Real-time Mobile App Fingerprinting via Traffic Behavior Correlation Graphs
MAppPrint fingerprints mobile apps from encrypted traffic using behavior graphs, including concurrent apps.
Google Play Hosted Fake Chrome App With 100,000+ Downloads
Google Play hosted a Hizbartech fake Chrome app, later removed, that showed 100,000-plus downloads.
6
1-click MMI execution in Android
Research shows vulnerable Android dialers can run MMI codes, including call forwarding, from one browser click.
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
Pwn2Own Ireland 2026 paid $1,262,000 for 98 zero-days, including Galaxy S26, Pixel 10, and OpenAI Codex.
Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland
Researchers collected $232,500 at Pwn2Own Ireland after 45 zero-days, including three Samsung Galaxy S26 hacks.
Pwn2Own Ireland 2026 - The Full Schedule
ZDI posted the Pwn2Own Ireland 2026 schedule, with over 60 entries including phones and AI targets.
Critical Capacitor Flaw Lets Malicious Links Access App Data and Native Features
Critical Capacitor flaw CVE-2026-103922 lets malicious in-app links access app data and native features.
4
Show HN: I built a free Burp/Caido alternative but, zero setup - API Testing
Apiaxess is a free, zero-setup Burp and Caido alternative for capturing and testing web and mobile APIs.
2
iOS 27.0.1 (24A446)
Apple released iOS 27.0.1 (build 24A446) with no vulnerability details in the notice.
What even is an OS now?
A Fly.io engineer is leaving to build a phone for user-conjured AI applications.
1
VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities
CERT/CC discloses three stored XSS flaws in Readwise Reader Android 8.7.2 that can run JavaScript in WebView.
ChatGPT mobile app gets voice-based agentic features
OpenAI added voice-based agentic workflows to the ChatGPT mobile app for paid and free users.