CyberWatch Newsroom Live Intel

Moderate Google Online Security

2026-03-31 Google Online Security

VRP 2025 Year in Review

Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearl…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Cloudflare Security

2026-03-30 Cloudflare Security

Cloudflare Client-Side Security: smarter detection, now open to everyone

Client-side skimming attacks have a boring superpower: they can steal data without breaking anything. The page still loads. Checkout still completes. All it needs is just one malicious script tag. If that sounds abstract, here are two recent examples of such skimming attacks: In January 2026, Sansec reported a browser-side keylogger running on an employee me…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Google Online Security

2026-03-25 Google Online Security

Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android

Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Trend Micro ZDI

2026-03-12 Trend Micro ZDI

Announcing Pwn2Own Berlin for 2026

If you just want to read the contest rules, click here . Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon . Outside of our shipping troubles , we had an amazing time and can’t wai…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Zero Day Vulnerabilities

Advisory

Important Cloudflare Security

2026-03-12 Cloudflare Security

Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

Today, Cloudflare is introducing a new suite of fraud prevention capabilities designed to stop account abuse before it starts. We've spent years empowering Cloudflare customers to protect their applications from automated attacks, but the threat landscape has evolved. The industrialization of hybrid automated-and-human abuse presents a complex security chall…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Important Cloudflare Security

2026-03-12 Cloudflare Security

Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

Today, Cloudflare is introducing a new suite of fraud prevention capabilities designed to stop account abuse before it starts. We've spent years empowering Cloudflare customers to protect their applications from automated attacks, but the threat landscape has evolved. The industrialization of hybrid automated-and-human abuse presents a complex security chall…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-03-11 Cloudflare Security

AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps detects and mitigates threats to AI-powered applications. Today, we're announcing that it is generally available. We’re shipping with new capabilities like detection for custom topics, and we're making AI endpoint discovery free for every Cloudflare customer—including those on Free, Pro, and Business plans—to give everyone v…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate CVE-2026-26144 Trend Micro ZDI

2026-03-10 Trend Micro ZDI

The March 2026 Security Update Review

I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Zero Day Vulnerabilities

Advisory

Moderate Google Online Security

2026-02-27 Google Online Security

Cultivating a robust and efficient quantum-safe HTTPS

Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-02-25 Google Online Security

Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse We’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is si…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Critical CVE-2026-20841 Trend Micro ZDI

2026-02-19 Trend Micro ZDI

CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad

In this excerpt of a TrendAI Research Services vulnerability report, Nikolai Skliarenko and Yazhi Wang of the TrendAI Research team detail a recently patched command injection vulnerability in the Windows Notepad application. This bug was originally discovered by Cristian Papa and Alasdair Gorniak of Delta Obscura. Successful exploitation of this vulnerabili…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Zero Day Vulnerabilities

Advisory

Moderate Google Online Security

2026-02-19 Google Online Security

Keeping Google Play & Android app ecosystems safe in 2025

Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust The Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-01-27 Google Online Security

New Android Theft Protection Feature Updates: Smarter, Stronger

Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, durin…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-10 Google Online Security

HTTPS certificate industry phasing out less secure domain validation methods

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certif…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-09 Google Online Security

Further Hardening Android GPUs

Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team Last year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-08 Google Online Security

Architecting Security for Agentic Capabilities in Chrome

Posted by Nathan Parker, Chrome security team Chrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the previe…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-03 Google Online Security

Android expands pilot for in-call scam protection for financial apps

Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and m…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Important Google Online Security

2025-11-20 Google Online Security

Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing

Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms. As part of our e…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Critical CVE-2025-48530 Google Online Security

2025-11-13 Google Online Security

Rust in Android: move fast and fix things

Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster . The 2025 data continues to validate the approach, with memory safety vulner…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Important CVE-2025-62452 Microsoft Patch Tuesday

2025-Nov Microsoft Patch Tuesday

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Patch KB: KB5046684

Vulnerability in Microsoft Windows components (Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability). Remediation requires deploying cumulative update KB5046684 or latest Patch Tuesday release.

Fix: Install cumulative update KB5046684 via Windows Update or Microsoft Update Catalog.

Windows 11 / Windows Server

Advisory

Important CVE-2025-62219 Microsoft Patch Tuesday

2025-Nov Microsoft Patch Tuesday

Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability

Patch KB: KB5046684

Vulnerability in Microsoft Windows components (Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability). Remediation requires deploying cumulative update KB5046684 or latest Patch Tuesday release.

Fix: Install cumulative update KB5046684 via Windows Update or Microsoft Update Catalog.

Windows 11 / Windows Server

Advisory

Important CVE-2025-62218 Microsoft Patch Tuesday

2025-Nov Microsoft Patch Tuesday

Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability

Patch KB: KB5046684

Vulnerability in Microsoft Windows components (Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability). Remediation requires deploying cumulative update KB5046684 or latest Patch Tuesday release.

Fix: Install cumulative update KB5046684 via Windows Update or Microsoft Update Catalog.

Windows 11 / Windows Server

Advisory

Important CVE-2025-62217 Microsoft Patch Tuesday

2025-Nov Microsoft Patch Tuesday

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Patch KB: KB5046684

Vulnerability in Microsoft Windows components (Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability). Remediation requires deploying cumulative update KB5046684 or latest Patch Tuesday release.

Fix: Install cumulative update KB5046684 via Windows Update or Microsoft Update Catalog.

Windows 11 / Windows Server

Advisory

Important CVE-2025-62215 Microsoft Patch Tuesday

2025-Nov Microsoft Patch Tuesday

Windows Kernel Elevation of Privilege Vulnerability

Patch KB: KB5046684

Vulnerability in Microsoft Windows components (Windows Kernel Elevation of Privilege Vulnerability). Remediation requires deploying cumulative update KB5046684 or latest Patch Tuesday release.

Fix: Install cumulative update KB5046684 via Windows Update or Microsoft Update Catalog.

Windows 11 / Windows Server

Advisory