VulnHub

Bransys ELD is facing serious security vulnerabilities that could allow unauthorized access to sensitive telemetry data and firmware. The vulnerabilities, identified as CVE-2026-86520, CVE-2026-86689, and CVE-2026-77960, affect versions of the Bransys ELD app on Android devices older than 11.00.00 and iOS devices older than 1.1.54. The issues include hardcoded credentials for MQTT and FTP, which could enable attackers to read real-time data and access sensitive information transmitted in cleartext. Users are urged to update their apps to the latest versions to protect against these risks, as exploitation could have significant implications for data integrity and privacy, especially in the transportation sector where the system is deployed.

Google has acknowledged a serious vulnerability in the Pixel Cellular Modem, identified as CVE-2026-58704, which has a CVSS score of 8.0. This flaw allows for privilege escalation due to a logic error, potentially enabling unauthorized access or control over affected devices. Although the company has indicated that there are signs of limited targeted exploitation, it is crucial for users of Pixel devices to be aware of the risks. The flaw could affect various models in the Pixel lineup, impacting their cellular modem functionality. Google has released patches to address this vulnerability, and users are encouraged to update their devices promptly to mitigate any potential threats.

Google has rolled out its September 2026 security patches to fix 110 vulnerabilities across its Pixel devices, including a significant zero-day flaw that has been actively exploited in targeted attacks. This zero-day vulnerability poses a risk to users, as it can be exploited by attackers to gain unauthorized access to devices. The timely release of these patches is crucial, as it helps protect users from potential data breaches and other malicious activities. Pixel device owners are encouraged to update their devices promptly to mitigate the risk associated with this flaw and the other vulnerabilities addressed in the patch. Staying up to date with security updates is essential for maintaining device security.

Recent reports indicate that the BlueMoon exploit kit is being used by various espionage-focused threat actors to target vulnerabilities in Google Chrome and Windows. These attackers are taking advantage of zero-day vulnerabilities to deploy their exploits quickly and opportunistically. This poses a significant risk to users of these platforms, as the vulnerabilities are actively exploited, potentially allowing unauthorized access to sensitive information. Organizations and individuals using affected versions of Chrome and Windows should prioritize updating their systems to mitigate these risks. The situation underscores the continuing need for vigilance in cybersecurity practices, particularly for software that is widely used.

Indonesia is facing a cybersecurity threat from a group known as GoldFactory, which is using a technique involving the Android Work Profile feature to distribute the Gigabud Trojan. This malicious software targets Android banking apps, allowing attackers to steal sensitive financial information from users. Another group, Mantax Otax, is reportedly spreading malware independently. This situation raises concerns for Android users in Indonesia, particularly those who rely on banking apps for financial transactions. The ability of these groups to exploit legitimate features in Android underscores the need for heightened vigilance among users and better security measures from app developers.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that these flaws are currently being exploited in the wild. The vulnerabilities include a heap-based buffer overflow in Fortinet products (CVE-2025-25249), an authentication bypass in Citrix NetScaler (CVE-2026-19490), an out-of-bounds write in Google Chromium's V8 engine (CVE-2026-87491), and another authentication bypass affecting Cisco Firewall Management Center (CVE-2026-20079). These vulnerabilities pose significant risks, especially to federal agencies, which are urged to prioritize quick remediation efforts based on a directive from CISA. While the directive primarily affects federal entities, CISA encourages all organizations to adopt similar risk-based practices to address these vulnerabilities effectively. Organizations are also invited to report any exploited vulnerabilities not yet listed in the KEV Catalog for evaluation.

Google has released updates to address 230 security vulnerabilities in Chrome, including a medium-severity bug known as CVE-2026-87491. This vulnerability is an out-of-bounds issue in V8, the JavaScript and WebAssembly engine used by Chrome. Notably, it is currently being exploited in the wild, which raises concerns for users and organizations that rely on this browser. This kind of vulnerability could allow attackers to execute arbitrary code within the browser's sandbox environment, potentially leading to unauthorized access or data breaches. Users and administrators are strongly advised to update their Chrome installations to the latest version to mitigate this risk.

A financially motivated hacking group has successfully executed a large-scale credential harvesting campaign using an autonomous, multi-agent attack framework. This operation was completed in under six hours, showcasing how attackers are increasingly using artificial intelligence to enhance their efficiency. The Google Threat Intelligence Group reported that these attacks are targeting various proprietary AI systems, raising concerns about the security of sensitive credentials. Organizations and users relying on AI technologies should be particularly vigilant, as the rapid execution of these attacks poses a significant risk to their data integrity and privacy. This incident illustrates the evolving tactics of cybercriminals and the need for improved defenses against such automated threats.

Researchers from the security firm Calif have demonstrated a new worm that can take over WeChat accounts through incoming calls, without the recipient needing to answer or interact with their phone. This attack requires that the caller is already in the victim's WeChat contacts. Calif tested the worm on three different phones, successfully showing how it propagates. The company reported this vulnerability to Tencent, the owner of WeChat, in July 2023. This type of attack raises significant concerns for users, as it exploits a common communication method and could potentially compromise personal information or lead to unauthorized access to accounts.

This week, a new cybersecurity issue emerged where attackers circumvented email image blocking by using scannable QR codes made from text. This means that even if users have images turned off in their email settings, they can still be targeted by these codes, which can be a nuisance for those relying on this precaution. In a separate incident, a trusted software source was compromised, resulting in the distribution of malicious code that steals user credentials. Additionally, a security protocol meant for managing networks securely was exploited, leading to further vulnerabilities. These incidents highlight ongoing challenges in maintaining online security and the need for vigilance among users and organizations alike.

Researchers have identified a new malware named JSCeal that targets Google authentication by stealing session cookies. This malware is particularly sophisticated, utilizing compiled V8 JavaScript and employing various obfuscation techniques to evade detection. It has capabilities for credential harvesting, surveillance, and traffic interception, making it a significant threat to user accounts and online security. The complexity of JSCeal means that it can effectively bypass standard security measures, which raises concerns for individuals and organizations relying on Google services. Users should remain vigilant and consider additional security measures to protect their accounts from potential exploitation.

Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.