How we found 24 Android vulnerabilities using our open source AI security agent
https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/
https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/
The GitHub Blog
How we found 24 Android vulnerabilities using our open source AI security agent
A look at the targeted AI taskflows behind these findings, the bugs they uncovered, and how to run the same open-source agent on your own app.
❤24⚡15👍13🤔11
CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC) https://github.com/0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF
GitHub
GitHub - 0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF: CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel…
CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC) - 0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF
😱23👍21💩13👨💻13
CVE-2026-86950: The Great Glyph Grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path
Blog: https://calif.io/research/the-great-glyph-grift
PoC: https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950
An in-the-wild iOS bug with a possible WhatsApp zero-click path
Blog: https://calif.io/research/the-great-glyph-grift
PoC: https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950
Calif
CVE-2026-86950: The Great Glyph Grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path.
❤30👻18👍15👏15
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Bitdefender
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender has identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.
🤯18🔥14❤11⚡10
How I Took Down a ₹1.2Cr Android Banking Fraud
https://medium.com/@im404/how-i-took-down-a-1-2-b4430d997c07
https://medium.com/@im404/how-i-took-down-a-1-2-b4430d997c07
Medium
How I Took Down a ₹1.2Cr Android Banking Fraud
A complete technical write-up of an engagement against an active Android banking-fraud operation — recon, malware internals, platform…
❤18🤯8🌚8⚡6👀5
Hirudo: From Fake Updates to Patched Banking Apps
https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
ThreatFabric
Hirudo: From Fake Updates to Patched Banking Apps
Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.
🎃20❤9
LEAD: LLM-Based Static Analysis of Session Hijacking Vulnerabilities in Android Deep Links
https://blog.cykor.kr/2026/10/LEAD-LLM-Based-Static-Analysis-of-Android-Deep-Links
https://blog.cykor.kr/2026/10/LEAD-LLM-Based-Static-Analysis-of-Android-Deep-Links
blog.cykor.kr
LEAD: LLM-Based Static Analysis of Session Hijacking Vulnerabilities in Android Deep Links - Your site
By Hyunseo Shin · October 2026 · Korean version
👍17❤14🎉9
Full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12
https://www.eshard.com/blog/kernel-uaf-1-trigger
https://www.eshard.com/blog/kernel-uaf-1-trigger
Eshard
Kernel UaF to Root #1: Freeing an Object That’s Still in Use | eShard
A use-after-free in Android's Binder driver, recorded once and replayed at will. Part 1 of a full kernel exploit chain built with time travel debugging.
👏21👍8🔥8😁5❤1
Baohuo, the gray eminence. Android backdoor hijacks Telegram accounts, gaining complete control over them
https://news.drweb.com/show/?i=15076
https://news.drweb.com/show/?i=15076
Dr.Web
Baohuo, the gray eminence. Android backdoor hijacks Telegram accounts, gaining complete control over them
Doctor Web has identified a dangerous backdoor, <a href="https://vms.drweb.com/search/?q=Android.Backdoor.Baohuo.1.origin&lng=en"><b>Android.Backdoor.Baohuo.1.origin</b></a>, in maliciously modified versions of the Telegram X messenger. In addition to being…
❤8⚡3😱3
How one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service (CVE-2026-80097)
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
Enclave
Enclave: AuthMask: We Made Microsoft Authenticator Hand Over Tokens to an App With Zero Permissions
How one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service.
❤11