NebuSec: Telegram Android Flaw Chain Can Hijack Phone on Call
October 30, 2026
NebuSec says a Telegram for Android flaw, chained with an info leak and a root exploit, could take over a
Endpoint Security
NebuSec: Telegram Android Flaw Chain Can Hijack Phone on Call
NebuSec says a Telegram for Android flaw, chained with an info leak and a root exploit, could take over a phone when a user answers ...
Hugging Face Mining Malware Returns, Model Hits 28,000 Downloads
Pluto Security found 31 malicious Hugging Face repositories posing as Qwen2 checkpoints that hijack GPUs for crypto mining, with more than 32,000 downloads.
CISA Flags ESXi CVE-2026-41709 and Fragnesia Linux Flaw as Exploited
CISA added VMware ESXi CVE-2026-41709 and Linux kernel flaw CVE-2026-46300 to KEV; CrowdStrike says China-nexus Warp Panda used the ESXi bug as a zero-day.
Yoba Campaign Hides XMRig Miner Behind Signed ChatGPT, Claude Files
Check Point says the Yoba campaign used fake GitHub pages for nonexistent AI apps to deliver an XMRig miner through signed OpenAI and Anthropic executables.
Fake FedEx Tax PDFs Deliver Sirius Backdoor That Survives Reset
Trellix details a Korean-language phishing campaign posing as FedEx that delivers a fileless Sirius Backdoor designed to persist through a full OS reset.
16-Year-Old EDK II PXE Flaw CVE-2026-97631 Runs Code Pre-Boot
A critical buffer overflow in TianoCore EDK II PXE code, CVE-2026-97631, can run code before Secure Boot loads, and no stable release contains a fix ...
Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape
Google's Chrome 156.0.8078.73 update fixes 52 flaws, four critical, including CVE-2026-118306, a FileSystem bug that allows code execution outside the sandbox.
Fake Claude Download Pages on claude.ai Spread Mac Stealer
Gen Digital found fake Claude install guides hosted on the real claude.ai domain, promoted by Google Ads, delivering Atomic macOS Stealer and a Windows RAT.
Apple Backports Exploited CoreGraphics Zero-Day Fix to iOS 18
Apple released iOS and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day, about a month after CISA added the flaw to its KEV catalog.
Public PoC Released for macOS autofs Root and Gatekeeper Flaws
A researcher published a PoC for macOS autofs flaws CVE-2026-84568 (root) and CVE-2026-84570 (Gatekeeper bypass), which Apple already patched in September.
Hugging Face Mining Malware Returns, Model Hits 28,000 Downloads
October 30, 2026
Pluto Security found 31 malicious Hugging Face repositories posing as Qwen2 checkpoints that hijack GPUs for crypto mining, with more
CISA Flags ESXi CVE-2026-41709 and Fragnesia Linux Flaw as Exploited
October 29, 2026
CISA added VMware ESXi CVE-2026-41709 and Linux kernel flaw CVE-2026-46300 to KEV; CrowdStrike says China-nexus Warp Panda used the ESXi
Yoba Campaign Hides XMRig Miner Behind Signed ChatGPT, Claude Files
October 29, 2026
Check Point says the Yoba campaign used fake GitHub pages for nonexistent AI apps to deliver an XMRig miner through
Fake FedEx Tax PDFs Deliver Sirius Backdoor That Survives Reset
October 29, 2026
Trellix details a Korean-language phishing campaign posing as FedEx that delivers a fileless Sirius Backdoor designed to persist through a
16-Year-Old EDK II PXE Flaw CVE-2026-97631 Runs Code Pre-Boot
October 29, 2026
A critical buffer overflow in TianoCore EDK II PXE code, CVE-2026-97631, can run code before Secure Boot loads, and no
Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape
October 28, 2026
Google’s Chrome 156.0.8078.73 update fixes 52 flaws, four critical, including CVE-2026-118306, a FileSystem bug that allows code execution outside the
Fake Claude Download Pages on claude.ai Spread Mac Stealer
October 28, 2026
Gen Digital found fake Claude install guides hosted on the real claude.ai domain, promoted by Google Ads, delivering Atomic macOS
Apple Backports Exploited CoreGraphics Zero-Day Fix to iOS 18
October 27, 2026
Apple released iOS and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day, about a month after CISA added the
Public PoC Released for macOS autofs Root and Gatekeeper Flaws
October 27, 2026
A researcher published a PoC for macOS autofs flaws CVE-2026-84568 (root) and CVE-2026-84570 (Gatekeeper bypass), which Apple already patched in
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.