Threat awareness

Threat awarenessEXPLAINER · 5 MIN READ

WhatsApp and ImageIO: why the 2025 exploit pairing needed two patches

An authorization flaw in WhatsApp and a memory-safety flaw in Apple’s ImageIO had different fixes. The case shows why app updates and OS updates need separate verification.

Threat awarenessEXPLAINER · 4 MIN READ

LANDFALL: the Samsung codec bug behind a targeted spyware campaign

Unit 42 linked recovered spyware samples to a Samsung image-decoding flaw. The report also leaves gaps in the delivery and privilege-escalation chain that should not be filled with assumptions.

Threat awarenessEXPLAINER · 5 MIN READ

DarkSword: six CVEs across several layers of iOS

The public reports connect JavaScript, graphics, shared-memory and kernel flaws. Understanding the kit also requires separating its payloads and following Apple’s later backports.

Threat awarenessEXPLAINER · 4 MIN READ

Inside Coruna: how an iOS exploit kit covered several software generations

Google reported five alternative iOS chains containing 23 exploits. Their version coverage, reuse and patch history explain why a small group of outdated devices can still matter.

Threat awarenessEXPLAINER · 4 MIN READ

Android CVE-2025-48633: when the advisory label and description disagree

Google’s record labels this flaw information disclosure but describes adding a Device Owner after provisioning. Keeping both parts visible changes what a device-management review needs to check.

Threat awarenessEXPLAINER · 4 MIN READ

Wireless ADB CVE-2026-0073: an encrypted connection to the wrong peer

Google fixed a certificate-verification error in Android’s wireless debugging service. The flaw concerns mutual authentication and shell access under adjacent or proximal conditions.

Threat awarenessEXPLAINER · 4 MIN READ

Android CVE-2025-48595: why the June 2026 patch date matters

The CVE carries a 2025 identifier, but Google’s June 2026 bulletin reports the fix and targeted exploitation. The disclosed issue involves integer overflows and local privilege escalation.

Threat awarenessEXPLAINER · 4 MIN READ

Qualcomm CVE-2026-21385: when memory-allocation arithmetic goes wrong

Qualcomm’s flaw concerns alignment calculations during memory allocation. The public record describes local access and targeted exploitation, while device-specific patch coverage depends on the manufacturer.

Threat awarenessEXPLAINER · 3 MIN READ

WebKit CVE-2026-64728: an iframe sandbox flaw, explained

Apple repaired how WebKit enforces an embedded document’s permissions. The fix concerns iframe policy, which is different from a browser process escaping into the operating system.