Vulnerabilities
Google Publishes Patch for Android Lock Screen Bug That Reportedly Let Gemini Send SMS Without a PIN
A mobile lock-screen bypass involving Gemini — defender verification across managed Android fleets this week.
Mobile Security
Apple Publishes Warning on FaceTime-Based Social Engineering Targeting iPhone and iPad Users
An Apple advisory on FaceTime-based social engineering — defender-team end-user awareness this week.
Nation-State Cyber Threats
Iran Abused Mobile-Network Vulnerabilities to Locate US Military Personnel, TechCrunch Reports
A nation-state mobile-network-vulnerability disclosure with defense-sector implications — coverage this week.
Data Privacy
Pegasus Spyware Infected the Phone of an MEP Investigating Spyware, TechCrunch and WIRED Report
A pointed export-control-policy disclosure — the spyware-inquiry rapporteur becomes the target.
Mobile Security
Researchers Disclose AirDrop and Quick Share Flaws Affecting Five Billion Devices
Two researchers mapped the proximity-sharing protocols behind AirDrop and Quick Share and found six flaws spanning five billion Apple and Android devices, with vendor fixes only partly shipped.
Mobile Security
Researchers Disclose 282 iOS AI Apps Leaking API Keys in Network Traffic
A scale-significant AI-app privacy disclosure with developer accountability implications: Wake Forest researchers found 282 of 444 iOS AI apps exposing usable LLM credentials in their own network traffic, and most stayed open months after notification.
Vulnerabilities
Apple Patches 30+ iOS, macOS, and Safari Flaws, Including AI-Discovered WebKit Bugs
Apple shipped an early, large patch cycle across iOS, macOS, and Safari — including four WebKit bugs surfaced by AI tools from OpenAI and Anthropic. For defenders, this is a device-verification week.
Mobile Security
Cellebrite Tooling Documented on Jailed Activist's iPhone After Stated Russia Cutoff
Cellebrite's stated sales-restriction practice gets fresh scrutiny via human-rights documentation, after researchers tied its forensic tooling to a jailed Russian activist's iPhone months after the company said it had pulled out.
Vulnerabilities
Researchers Disclose macOS Flaw Allowing Standard Users to Disable EDR and MDM
A macOS endpoint-protection bypass with defender posture-review implications. XM Cyber researchers showed that a standard, non-admin user can silently unload EDR and MDM agents on macOS, abusing legitimate XPC behavior rather than a single patchable bug.
Threat Intelligence
Meta Files Federal Contempt Motion Against NSO Group Over Alleged WhatsApp Targeting
Meta's contempt filing tests whether court-ordered restrictions are effectively binding on a commercial spyware vendor.
Artificial Intelligence (AI)
A Poisoned Notification Can Hijack Google Gemini's Voice Assistant on Android
SafeBreach researchers found that a single poisoned notification — from WhatsApp, Slack or SMS — could hijack Google Gemini's voice assistant on Android with no malicious app installed, reaching smart-home controls and poisoning the assistant's long-term memory. Google has patched it.
Vulnerabilities
Google Patches Actively Exploited Android Framework Zero-Day CVE-2025-48595
Google's June 2026 Android update fixes CVE-2025-48595, an Android Framework integer overflow that Google says may be under limited, targeted exploitation. Because the Framework is the API layer every app touches, the flaw can hand an attacker complete control of an unpatched device.