Security researcher Mark Blah released a working exploit for a zero-click Android vulnerability that lets attackers crash phones or disrupt cellular service by sending a single malformed eight-byte WAP Push message over SMS. The bug stems from unchecked header-length parsing in Android's WapPushOverSms.decodeWapPdu function, which triggers a crash in the com.android.phone process and can drop active calls, including emergency calls. Google patched the issue for Android 14 through 17 in its October 2026 update, though it wasn't listed in the public bulletin, leaving Android 12 and 13 devices unprotected.
bleepingcomputer.com
· 2026-10-31
Apple's iOS 27.2 update, released this week alongside more than 160 vulnerability fixes, addresses a flaw tracked as CVE-2026-86990 in the CoreMedia framework. The bug, credited to researcher Mustafa Calap, could allow an app to access the camera without triggering the usual permission prompt, though Apple's notes only describe it as improved access restrictions. The issue is software-based and does not involve the camera's hardware LED indicator, which remains tied directly to the camera module.
9to5mac.com
· 2026-10-30
Anthropic security researchers created a working exploit for CVE-2026-98432, a use-after-free bug in the Linux kernel's IPv4 TCP code rated 9.8/10 in severity. The flaw lets unauthenticated attackers achieve remote root code execution on servers running Multipath TCP listeners, and it also affects ordinary TCP connections across kernels back to version 4.4, including Ubuntu, RHEL and Rocky Linux, though RCE on non-MPTCP servers hasn't been publicly shown.
bleepingcomputer.com
· 2026-10-30
Netgear has issued a security advisory for CVE-2026-11732, a vulnerability that lets an attacker already on a user's network run unauthorized commands on certain routers if the Block Sites feature is enabled. Affected models include the CAX30, RAX30, RAX5, and RAXE300, and Netgear has released firmware updates for all supported devices. One model, the RAX5, has reached end of support and will not receive further patches.
zdnet.com
· 2026-10-30
Starbucks disclosed during its fiscal Q4 and full-year 2026 earnings report that it plans to open hundreds of new stores in the U.S. during 2027 and 2028. The announcement comes after the company closed a number of underperforming locations in recent months.
fastcompany.com
· 2026-10-30
WIRED reports early Black Friday discounts on mattress brands it has tested, including Helix and Birch. Helix is offering 20 percent off sitewide with a promo code, plus up to 25 percent off its Luxe line and 30 percent off its Elite line, while Birch has a 25 percent discount on its Luxe Natural mattress. The Helix codes are valid through November 29.
wired.com
· 2026-10-30
TechCrunch is holding its Founder Summit 2026, sponsored by Fidelity Private Shares, featuring two breakout stages—Build and others—with sessions on distribution, fundraising, AI opportunities, and pitching, plus interactive roundtables. Registration remains open for five more days, with early signup offering up to $100 off a pass and a second pass free. Speakers include Hunter Worland of NEA, Amulya Vishwanath of Techable VC, and Dave Balter of True Ventures.
techcrunch.com
· 2026-10-30
With Halloween landing on a Saturday this year, a lifestyle roundup offers seven last-minute costume ideas drawn from recent pop-culture headlines for people who haven't yet planned an outfit. The suggestions are aimed at party-goers seeking quick, recognizable looks rather than elaborate handmade costumes.
fastcompany.com
· 2026-10-30
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
bleepingcomputer.com
· 2026-10-30
Apple has released a MacBook Pro featuring an OLED 'PROLED XDR' display and, for the first time, touchscreen support, running macOS 27 Golden Gate. The touch functionality lets users tap and swipe the screen, with some UI elements in certain apps magnifying or expanding slightly in response, while mouse and trackpad input remain fully functional.
theverge.com
· 2026-10-30
Drupal issued a highly critical advisory for CVE-2026-118539, a missing-authorization bug in its Commerce Core module that lets unauthenticated attackers bypass access controls. The flaw affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13, and Drupal says it is already being exploited. Admins are urged to update to 3.3.13 or 8.x-2.41 and review order records for signs of tampering.
bleepingcomputer.com
· 2026-10-30
A use-after-free bug has been identified in the Linux kernel's IPv4 TCP handshake code, where a race condition between processors can leave a stale pointer to a freed IP options object. The CVE record rates it 9.8 on CVSS 3.1 as a worst-case network-reachable flaw, while Red Hat scores it 5.9 for its supported products, and Anthropic's Frontier Red Team separately demonstrated a working remote root exploit in a lab setup using a Multipath TCP listener.
penligent.ai
· 2026-10-30
GoKawiil