Exploitation observed; activity peaked at 38 mentions and remains active
Immediate actions
Patch google android systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-05. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
June 2026 Android Security Bulletin notes CVE-2025-48595 is being exploited in the wild. It's being widely misreported in tech media as a 0-day vulnerability being exploited. That's a major misunderstanding of Android Security Bulletins and how poorly OEMs keep up with patches.
Google disclosed CVE-2025-48595 to OEMs in a security preview release near the end of September 2025. Those patches are allowed to be shipped right away, so it was included in our 2025092501 release. We noted it was already publicly fixed so it was added to our regular releases too in 2025100300.
We quickly shipped the patch after it was disclosed to OEMs by Google but we plan to do better in the future. SQLite 3.44.5 was released with this backport on 2025-07-24. We weren't previously aware SQLite maintained upstream LTS branches for Android but our plan is to closely follow those now.
In this case, Google slipped up and took 2 months to add the patch to the security preview releases. We plan to avoid that in the future by handling this ourselves because this happens too often. It's also a nice example of how Android Security Bulletins are set extremely low expectations for OEMs.
GrapheneOS quickly ships all security preview patches. Every AOSP patch included in the Android Security Bulletins was already available in GrapheneOS for over a month. We end up shipping patches 2-3 months earlier. Google having such low expectations for OEMs and even themselves is ridiculous.
Android's security patch system doesn't make any sense and is completely at odds with how quickly people can discover and exploit vulnerabilities with the help of LLMs. The security preview release system would be far more reasonable if the embargo for sources and details was no more than 48 hours.
Google's embargo system harms security for nearly all Android users by setting the expectation of patches taking 2 to 6 months for OEMs to ship after disclosure. Patches are available to sophisticated attackers as soon as Google discloses them to OEMs. A partial embargo for months makes no sense.
Post summary
The note confirms that CVE-2025-48595 is actively being exploited while highlighting misreporting, patch timelines, and OEM response challenges.
Vulnerabilidad de Android permite control total del dispositivo
Se ha detectado una vulnerabilidad crítica de día cero en Android, identificada como CVE-2025-48595
https://blog.elhacker.net/2026/06/vulnerabilidad-de-android-permite.html
Post summary
The post announces the discovery of a new Android zero‑day (CVE‑2025‑48595) claiming full device control, but provides no PoC, exploit code, or patch information.
🚨 Android just patched 124 security flaws.
One of them — CVE-2025-48595 (CVSS 8.4) — may already be seeing limited targeted exploitation.
No user interaction required. #Android 14, 15, 16, and 16 QPR2 affected.
Read: https://thehackernews.com/2026/06/google-june-2026-android-update-patches.html
Post summary
A recent Android patch addresses CVE-2025-48595, a CVSS 8.4 flaw that is already being targeted in limited real‑world attacks, with no user interaction required.
🛡️ We added Linux Kernel improper authentication vulnerability CVE-2022-0492 & Android Framework integer overflow vulnerability CVE-2025-48595 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. https://t.co/xrUH6q20rm
Post summary
The message announces the addition of CVE-2022-0492 and CVE-2025-48595 to a known exploited vulnerability catalog and urges organizations to apply mitigations, but offers no PoC, exploit code, or patch specifics.
🚨 CVE-2025-48595: SMA100 Buffer Overflow
Critical Vulnerability Alert!
Android is affected by CVE-2025-48595.
Full Vulnerability Details & Analysis at DarkEye:
🔗 https://darkeye.org/vuln/cve/CVE-2025-48595
🔍 Identify Targets via ZoomEye:
Filter: vul.cve="CVE-2025-48595"
Search Dork: app="Android"
Exposure: 50.1k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJBbmRyb2lkIg==&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260629
#Infosec#CyberSecurity#ZoomEye#DarkEye
Post summary
A critical buffer overflow vulnerability (CVE-2025-48595) affecting Android is disclosed with analysis links and mentions 50.1k reported instances via ZoomEye.
CVE-2025-48595 is an integer overflow zero‑day affecting Android 14+, actively exploited in targeted attacks, with a patch already distributed for Pixel devices.
🚨 Android juin 2026
➡️ 124 failles patchées
⚠️ Une est déjà exploitée
Google a sorti son bulletin le 1er juin. Parmi les 124 correctifs, CVE-2025-48595 sort du lot...
C’est un integer overflow dans le Framework. Ça permet une élévation de privilèges locale. Une fois déclenchée, aucune interaction utilisateur n’est nécessaire
Versions touchées : Android 14, 15, 16 et 16 QPR2
Le CISA l’a ajoutée à son catalogue des vulnérabilités activement exploitées le 2 juin
Ce n'est pas une attaque de masse, mais déjà utilisée contre des cibles précises. Dans le Framework, ça donne un accès profond une fois exploitée
👉 La plupart des constructeurs vont mettre des semaines à pousser le patch. Pixel en premier, les autres après !
👀 Va dans Paramètres et À propos du téléphone, check le niveau de correctif. Tu veux 2026-06-01 minimum
Même corrigé par Google, tout le monde n’est pas protégé en même temps dans un écosystème fermé.
Post summary
CVE‑2025‑48595, an integer‑overflow privilege escalation in Android’s Framework, is actively exploited and already in the wild; Google has released a patch but device vendors may take weeks to fully deploy the fix.
Google’s June 2026 Android update patched 124 vulnerabilities. One of them is already being exploited.
CVE-2025-48595 is an elevation-of-privilege flaw in the Android Framework affecting Android 14 through 16. Google confirms limited targeted exploitation is already underway. No user interaction required.
Here is where the backend risk enters.
A privileged device compromise does not stay on the device. Attackers gain access to application credentials, session tokens, and trusted app contexts that communicate directly with backend services. The mobile client becomes the entry point. Your API becomes the target.
Too many teams draw a line between mobile security and backend security and treat them as separate problems. In 2026 that line does not exist.
If the device is owned, the trust your backend extends to that device is compromised too. That is the gap.
Post summary
CVE‑2025‑48595, an elevation‑of‑privilege flaw in Android 14‑16, has already been actively exploited in targeted attacks, prompting Google to address it in its June 2026 update.
今日のセキュリティは、国内体制の刷新、足元の権限昇格、古傷の再悪用、そしてAIによるN-day自動生成が同じ卓に並んだ日だ。守る側の時間が、また削られている。
・警察庁、初の民間出身者を重大サイバー事案対策戦略官に起用
・富士通系ServerView Agentsに権限昇格2件、CVE-2026-27788/32325
・CISA、AndroidとLinuxの古傷(CVE-2025-48595/CVE-2022-0492)悪用を警告
・研究者がClaude Opus 4.7でWindowsパッチからN-day半自動生成PoC公開
・AIエージェントOpenClawのSlack/Discord連携で表示名なりすまし5件
君の現場の「異常なし」は、本当に異常なしか？パッチを当てて満足していないか？攻撃側がAIで加速する一方、守る側の手数は、本当に足りているか？俺は、現場のリアルから目を逸らさん。
Post summary
A researcher released a semi‑automated PoC for CVE‑2026‑27788 and CVE‑2026‑32325, while CISA alerting on active exploitation of CVE‑2025‑48595 and CVE‑2022‑0492 on Android and Linux.
@policia@C1b3rWall Ah, venga, sí. El DNI, los bancos, el carnet de conducir y el zero day de Android CVE-2025-48595 en el mismo pack. Qué podría malir sal
Post summary
The tweet merely references the zero‑day Android vulnerability CVE‑2025‑48595 with no additional details or actionable information.
@elhackernet Corregida en @GrapheneOS desde principios de octubre de 2025.
"CVE-2025-48595 was fixed in the regular GrapheneOS 2025100300 release and is no longer listed."
Post summary
CVE-2025-48595 has been addressed in GrapheneOS version 2025100300 and is no longer listed, indicating that a patch has been released.
🛡️ CVE-2025-48595
Les patchs de sécurité de juin 2026 pour #Android ont été mis en ligne par #Google
🎯 Au total, ce ne sont pas moins de 124 vulnérabilités corrigées par la firme de Mountain View, dont une faille de #sécurité zero-day.
#CVE
https://www.it-connect.fr/android-le-patch-de-juin-2026-corrige-une-faille-zero-day-deja-exploitee/
Post summary
The June 2026 Android security patches remedied 124 vulnerabilities, including a zero‑day that had already been exploited, but the post provides no PoC, exploit code, or technical details.
Analyze the critical CVE-2025-48595 Android zero day flaw. Learn how this zero-click privilege escalation bug affects core devices and how to fix it.
#AndroidSecurity#CVE202548595#ZeroDay#MobileSecurity#InfoSec#ThreatIntel#AOSP
https://meterpreter.org/cve-2025-48595-android-zero-day/ https://t.co/FvxXsAQPB2
Post summary
The tweet highlights a critical Android zero‑day CVE-2025-48595, focusing on how to mitigate the zero‑click privilege escalation flaw rather than detailing exploitation or patch specifics.
CISA warns of active exploits targeting #Android and #Linux flaws (CVE-2025-48595 & CVE-2022-0492). The Android bug allows privilege escalation with zero user interaction! ⚠️
Visit @CISAcyber for more
Post summary
CISA reports that CVE-2025-48595 and CVE-2022-0492 are being actively exploited on Android and Linux, with the Android flaw enabling zero‑interaction privilege escalation.
"There are indications that CVE-2025-48595 may be under limited, targeted exploitation." https://source.android.com/docs/security/bulletin/2026/2026-06-01
Post summary
The bulletin signals that CVE-2025-48595 may be experiencing limited, targeted exploitation, but it lacks evidence of active code or remediation details.
Google fixes 124 Android flaws, including actively exploited zero-day CVE-2025-48595 that can let local attackers run code and gain higher privileges on Android 14 or later
#Google#Android#CVE202548595#ZeroDay#TechNews https://t.co/WQjirh3LUV
Post summary
Google has released patches for 124 Android vulnerabilities, including the actively exploited zero‑day CVE‑2025-48595 that enables local privilege escalation on Android 14 and later.
CISA KEV roundup: Linux cgroups escape, Android Framework, Magento RCE all actively exploited
Three additions to CISA's Known Exploited Vulnerabilities catalog this week: CVE-2022-0492 (Linux kernel cgroups v1, container escape via improper auth), CVE-2025-48595 (Android Framework integer overflow), and CVE-2026-45247 (Mirasvit Full Page Cache Warmer for Magento 2 unauthenticated RCE via PHP object injection in CacheWarmer cookie, patched in v1.11.12). Feds have 21 days to patch.
Source: CISA / BleepingComputer
Full analysis → http://t.me/VulnerabilityNews
Follow @VulnerabilityNw
Post summary
CISA reports three CVEs—Linux cgroups escape, Android Framework integer overflow, and Magento RCE—currently being exploited in the wild, with patch guidance provided.
Android Zero-Day Patched June 2026 Update
Google patches CVE-2025-48595 an actively exploited Android zero-day used in limited, targeted attacks.
The June 2026 security update addresses 124 total vulnerabilities. Exploitation confirmed in the wild before the patch landed.
Sources: BleepingComputer / SecurityWeek
Full analysis → http://t.me/VulnerabilityNews
Follow @VulnerabilityNw
Post summary
Google released a patch for CVE‑2025‑48595, an actively exploited Android zero‑day, and confirms the vulnerability was being exploited in the wild before the update.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — June 02, 2026
1️⃣ GOOGLE PATCHES EXPLOITED ANDROID ZERO-DAY CVE-2025-48595
Google released its June 2026 Android Security Bulletin addressing 124 vulnerabilities, including a critical zero-day flaw (CVE-2025-48595) that is already being exploited in targeted attacks. The vulnerability is an integer overflow in the Framework layer affecting Android 14 and later, with confirmed exploitation in the wild. This marks the sixth zero-day with confirmed exploitation since September 2025, underscoring the accelerating pace of mobile threat activity. Device owners are urged to update immediately through the latest security patch.
@NewsNerdie
2️⃣ ANTHROPIC EXPANDS MYTHOS AI CYBERSECURITY MODEL TO 200 ORGANIZATIONS
Anthropic significantly expanded access to its Mythos cybersecurity AI research model, granting ~200 organizations across power, healthcare, communications, and critical software maintenance sectors the ability to use it. The model has already identified over 10,000 serious software vulnerabilities since its initial release. The EU cybersecurity agency ENISA was also granted access, signaling growing institutional trust in AI-driven vulnerability detection. This represents a major shift toward AI-augmented security operations at scale.
@FuturumEquities
3️⃣ ORACLE WEBLOGIC CVE-2026-21962 — CVSS 10.0 RCE ACTIVELY EXPLOITED
A critical remote code execution vulnerability in Oracle WebLogic Server (CVE-2026-21962, CVSS 10.0) is being actively exploited in the wild. The flaw allows unauthenticated attackers to achieve RCE via path traversal in the HTTP Server/Proxy Plugin component. Given Oracle WebLogic's widespread deployment in enterprise environments, this poses an immediate and severe risk. Organizations running WebLogic should prioritize patching or deploy compensating controls without delay.
@ThreatAft
4️⃣ RED HAT NPM PACKAGES COMPROMISED IN SUPPLY-CHAIN ATTACK
More than 30 npm packages under Red Hat's "@redhat-cloud-services" namespace were compromised in a supply-chain attack distributing a new variant of the Shai-Hulud credential-stealing malware. The malicious packages were designed to harvest developer credentials during installation. This incident highlights the persistent risk of package repository compromises and reinforces the need for strict dependency auditing and signed package verification in development workflows.
@TechKimmi
5️⃣ WORDPRESS WP MAPS PRO VULNERABILITY BLOCKS 2,800+ ATTACKS IN 24 HOURS
A critical vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) allows unauthenticated attackers to create admin-level accounts. Within a single day, over 2,800 exploitation attempts were recorded and blocked by security monitoring services. The fix is available in version 6.1.1. With WordPress powering 43% of all websites, plugin vulnerabilities like this remain one of the most common attack vectors against web infrastructure.
@dailytechonx
6️⃣ HP POLY VOICE PHONES VULNERABLE TO ROOT-LEVEL RCE
HP Poly Voice VVX and Trio IP phones are affected by a critical flaw (CVE-2026-0826) that enables root-level remote code execution through malicious SIP/SDP traffic when ICE is enabled. This vulnerability can serve as an entry point for broader enterprise network compromise, as VoIP phones are often deployed on the same network segments as corporate devices. Organizations using affected devices should apply vendor patches or disable ICE functionality as an interim measure.
@TweetThreatNews
7️⃣ MINECRAFT MALWARE-AS-A-SERVICE: MCAFEE REPORTS WEEDHACK CAMPAIGNS
McAfee published a detailed analysis of "WeedHack," a sophisticated Malware-as-a-Service campaign targeting Minecraft players. The operation uses fake Minecraft mods and servers to distribute malware, demonstrating how threat actors increasingly leverage popular gaming platforms to reach younger audiences. The report outlines the full infection chain, infrastructure, and monetization methods behind the campaign, serving as a case study in how gaming communities are being weaponized for cybercrime.
@AndreGironda
💭 The cybersecurity landscape in early 2026 shows a clear trend: vulnerabilities are being discovered and exploited faster than ever. From Oracle's CVSS 10.0 WebLogic flaw being weaponized immediately, to Red Hat's own npm supply chain being compromised, the window between disclosure and exploitation continues to shrink. The good news is that AI tools like Anthropic's Mythos are scaling up to meet this challenge, identifying tens of thousands of vulnerabilities before attackers can find them. The race is between automated discovery and automated exploitation — and the side that moves faster wins.
Which cybersecurity development surprised you the most this week? Share your thoughts 👇
#Cybersecurity#InfoSec#ZeroDay#OpenSource#Privacy#ThreatIntelligence
Post summary
The roundup highlights several high‑severity vulnerabilities—some actively exploited and all requiring immediate patching—underscoring the rapid pace of mobile, enterprise, and web‑application exploits in early 2026.
