Android Update Fixes 200 Flaws, Including Critical Wi-Fi RCE

Google's September 2026 Android security update fixes 200 vulnerabilities, including a critical Wi-Fi-related bug tracked as CVE-2026-28662 that could allow remote code execution without user interaction. Adam Boynton, enterprise strategy manager at Jamf, said the Wi-Fi memory corruption flaw is the most concerning from the list because an attacker could use it to execute code remotely, escalate privileges, and take control of an unpatched device. The update should be pushed to all Android devices in an organization as soon as possible to close that risk.

In the browser space, researchers at Socket found four malicious extensions for Google Chrome and Mozilla Firefox that target users of Axiom Trade and Padre. The extensions are J7Tracker (Chrome), VREO (Chrome and Firefox), and Orbit Tracker (Firefox). The first three share a byte-identical collection module that automatically retrieves authenticated user information, wallet bundle data, Firebase access tokens, and application state, then sends it to Vercel deployments controlled by the attacker. The fourth extension uses a different collector but targets the same data and retains artifacts from J7Tracker. The same Chrome publisher was traced to two earlier extensions called GhostApe and GhostApe Color that impersonated the MockApe trading add-on. Separately, Google has shifted Chrome to a two-week major release cycle with weekly security updates. The company said LLM-assisted vulnerability discovery has increased the volume of bugs found and fixed, and the faster cadence is meant to reduce the patch gap, the time between a public fix and end users actually receiving it.

Another investigation by Netby uncovered DoppelCart, a fake e-commerce operation using more than 119,000 domains. The counterfeit shops mimic 44,182 different real brands by copying product catalogs, descriptions, branding, and images, sometimes loading assets directly from the genuine company's servers. Each clone undercuts the real brand's prices and republishes the brand's own support address, so victims who get charged complain to the real business instead of the scam shop. The shops exist to steal payment card details from shoppers who believe they are buying from a trusted retailer.

Hunt.io reported that a Chinese-speaking operator has used Anthropic Claude Code, Alibaba Qwen, and DeepSeek together with an AI orchestration framework called SecFlow to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the United States. The attacker exploited known vulnerabilities including Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus path traversals, and a Nacos authentication bypass. After exploitation, the operator deployed web shells generated through a capability called GLUTTON, then used them for reconnaissance, privilege escalation, credential theft, and deployment of a Go-based backdoor named SecBox. The U.K. National Cyber Security Center separately warned that shadow AI, the use of unapproved AI tools by employees, can expose sensitive corporate data and increase the risk of data breaches, intellectual property loss, and regulatory failure.

Microsoft is bringing age-awareness APIs called Windows Age API to Windows 11, allowing apps to determine whether a user is a child, teenager, or adult without exposing their exact date of birth. The company said this helps developers build safeguards from the start rather than leaving protection to families to manage app by app. In another scam pattern, Gen Digital reported a phantom deal fraud campaign in which attackers posed as executives and tricked legal teams into moving merger and acquisition discussions to WhatsApp and personal email. The attackers used forged acquisition documents that followed substantially the same structure and reused legal language, imposed confidentiality, and created a short period between the NDA date and the supposed public announcement, all to initiate international wire transfers.

Several incidents this week involved phishing and account takeover. Trezor, a cryptocurrency hardware wallet maker, warned customers after its email provider Brevo was breached. The incident affected 120 Brevo accounts, including Trezor's, and exposed roughly 347,000 email addresses from the company's opt-in newsletter database. Attackers used the compromised account to send a phishing email titled 'Critical Security Alert: STM32 Entropy Vulnerability' that contained a link to a fake app asking users to enter their wallet backup phrase. Trezor suspended the Brevo account and the malicious domain was taken down. In Singapore, two men aged 25 and 47 were arrested for a Singpass compromise scheme. Working at a mobile phone shop, they allegedly offered to help customers update the phone number linked to their Singpass account, then used the opportunity to create LiquidPay accounts without the customer's knowledge. More than 170 Singapore citizens and foreign workers had their Singpass accounts linked to the activity, and those fraudulent accounts were used to register over 160 additional LiquidPay accounts. The U.S. Justice Department announced the extradition of Sergei Anatolyevich Filimonov, a 36-year-old Russian national, who is accused of running spoofed banking login pages and maintaining databases with more than 5,000 stolen login credentials for bank account takeover fraud.

Shadowserver Foundation data shows more than 33,800 exposed Plex servers remain vulnerable to recently disclosed flaws, down from 37,467 on September 5, 2026, with nearly 20,000 of those in North America. The DFIR Report described an attack chain in which EtherRAT was installed through a malicious MSI installer disguised as a Sysinternals tool. The same campaign delivered TukTuk, an AI-generated malware framework that uses the Arweave blockchain as a dead-drop resolver, and GoTo Resolve remote management software. The attacker then performed Kerberoasting and credential discovery, moved laterally to servers and domain controllers, exfiltrated data, and deployed The Gentlemen ransomware. CISA released an updated Insider Threat Mitigation Guide that addresses hybrid work, AI-based manipulation, access control, and visitor screening. In a separate case, James Strahler II, 37, of Columbus, was sentenced to 15 years in prison for using more than 24 AI platforms to create non-consensual explicit images and intimidating victims with threats of violence.

Across these reports, the common thread is that weak edges, unpatched systems, and over-trusted access gave attackers a path in. For website owners and IT teams, the practical response is disciplined patching, careful review of third-party tools, and ongoing monitoring. A security-first IT and consulting service such as AEU-I can provide the patch management and monitoring discipline that these recent incidents show is needed, without requiring an in-house security team.