49 stories, newest first · one card per story
The November 2026 Android security update addresses more than 200 vulnerabilities, including critical remote code execution flaws that require no user interaction.
APT29 deploys n-day exploits via watering-hole sites on iOS and Android devices with no user interaction.
A five-byte WAP Push kills com.android.phone; Google patched Android 14–17 in October 2026, while 12 and 13 may stay exposed.
.jpg&w=828&q=75)
A public proof of concept sends a malformed WAP Push that crashes com.android.phone and can drop emergency calls.
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
The disclosure describes denial of service, not code execution, and queued messages can crash the phone again after reboot.
Repeated messages can corrupt the SMS database so the phone app crashes on every boot, and Google marked it Won’t Fix.
Aziz says logic flaws bypass server checks Telegram cited against rlottie bug CVE-2026-111105; no public proof or patch.
European Parliament members asked the EU to investigate whether institutions can be infected through online advertising.
Researchers say Israeli firm Discover-Tech links ad vendors to Candiru and Bindecy zero-click spyware.
Citizen Lab's AdFection report says Discover-Tech ads carried zero-click mercenary spyware, including impressions on government networks.
Citizen Lab reports a high-confidence zero-click infection in 2026, bringing known Serbian civil-society spyware cases to at least 16.
Citizen Lab reports a high-confidence zero-click infection but does not name the operator, date, or flaw.
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
Citizen Lab reports a zero-click Pegasus infection on a Belgrade rector's phone in 2026; a prosecutor's spyware type is still unidentified.
Citizen Lab says Controlium infected devices when ads rendered, and those ads reached almost 200,000 sites and apps.
Citizen Lab says Candiru infected at least 45 Al Jazeera devices through Discover-Tech zero-click ads.
Citizen Lab says Candiru spyware hit Al Jazeera devices through zero-click malicious ads called AdFection.
Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.
Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.
Citizen Lab says Candiru used Discover-Tech ads to zero-click infect Al Jazeera journalists and reach sensitive government networks.
Citizen Lab says Candiru spyware hit at least 45 Al Jazeera devices via zero-click ads.
Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click malicious online ads called AdFection.
Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware that infected Al Jazeera devices.
Today 1.5K readers · 2.4K views · 753 reads · all time 189K views