TL;DR Google's November 2026 Android Security Bulletin fixes 216 vulnerabilities across two patch levels. The worst is a critical Framework flaw that allows remote code execution with no user interaction. This Android security update also patches 22 other critical bugs in System, the kernel and chipset components. Patch level 2026-11-05 fixes every issue in this month's bulletin. Three critical bugs allow zero-click remote code execution on Android 14 through 17.

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

A newly uncovered zero-click flaw threatens millions of mobile handsets worldwide. Specifically, the Android SMS of Death vulnerability forces essential telephony services into endless termination loops. Security researcher Mark Blah disclosed that malformed cellular transmissions cause critical system crashes. Furthermore, malicious actors execute this disruptive assault without requiring user interaction or visual confirmation. Consequently, vulnerable devices experience devastating denial of service conditions silently.

Android SMS of Death: Zero-Click Flaw Crashes Calls According to a recent report by technology outlet Gigazine on October 30, security researcher Mark Blaschczyk has uncovered a severe flaw. He discovered a formidable zero-click denial-of-service vulnerability within the Android operating system. Experts ominously dubbed this exploit the "SMS of Death". How the Zero-Click Exploit Works By simply dispatching a specially crafted text message to a targeted mobile device, an attacker can severely disrupt the recipient's calling capabilities.

Android SMS of Death: Zero-Click Flaw Crashes Calls According to a recent report by technology outlet Gigazine on October 30, security researcher Mark Blaschczyk has uncovered a severe flaw. He discovered a formidable zero-click denial-of-service vulnerability within the Android operating system. Experts ominously dubbed this exploit the "SMS of Death". How the Zero-Click Exploit Works By simply dispatching a specially crafted text message to a targeted mobile device, an attacker can severely disrupt the recipient's calling capabilities.

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.

Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto

Las respuestas de IA ganan terreno en Google y cambian la búsqueda web: más comodidad para el usuario, pero también más riesgo de ‘zero click’.

Citizen Lab Exposes a New Ad-Based Attack The Citizen Lab at the University of Toronto has published a report on a new way to deliver commercial spyware through targeted advertising. Researchers named the technique AdFection. Attackers use the ad bidding system to pick out specific devices. Then they load malicious code the moment an ad appears. The victim never clicks an ad or downloads a file.

Australia's nuclear science agency and other highly sensitive government organisations have been targeted by a sophisticated, foreign bad actor that secretly weaponised online ads to install spyware.

타깃 광고 제로클릭 공격은 사용자가 링크를 누르거나 파일을 열지 않아도 스파이웨어를 설치할 수 있는 경로로 확인됐습니다. 2026년 10월 15일 Citizen Lab 보고서에 따르면, 광고 공급망을 악용한 AdFection 캠페인이 2024~2025년 알자지라의 기기 45대를

A new ‘zero-click’ hack uses ads to target victims without any action needed on their part.

YouTube video by Al Jazeera English

TikTok video by Al Jazeera English

Welcome to The Daily Wrap Up, an in-depth investigatory show dedicated to bringing you the most relevant independent news, as we see it, from the last 24 hours (10/10/26). As always, take the informat...

The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.

Researchers from The Citizen Lab at the University of Toronto have uncovered a sophisticated spyware campaign that infects devices through targeted online advertisements, marking the first publicly available technical evidence of such an attack. Dubbed 'AdFection,' the campaign involves an Israeli-registered advertising firm, Discover-Tech, allegedly linked to spyware developer Candiru, which infected dozens of devices with invasive malware. The attack exploits the zero-click vulnerability, meaning no user interaction is required for malware installation, making it particularly dangerous as victims remain unaware of the infection. Citizen Lab's analysis revealed that 45 devices belonging to Al Jazeera were targeted between 2024 and 2025, with infected devices connecting to domains linked to Discover-Tech and Candiru's infrastructure. The researchers found that Discover-Tech's advertising platform, Controlium, could de-anonymize, fingerprint, and automatically infect devices once an ad appeared. Over 70,000 mobile apps and 120,000 websites displayed ads linked to Discover-Tech between March and June of this year, with multiple apps showing over a million such ads. The campaign also targeted government and national-security networks, including NATO, UN, and defense agencies in Norway and Sweden. Google and the Interactive Advertising Bureau (IAB) Europe have taken action, suspending Discover-Tech from their platforms after confirming the spyware link. The findings highlight the risks of the ad ecosystem being exploited for malicious purposes, with Citizen Lab warning that without changes to the architecture or stricter vetting by ad companies, such abuse will continue. The report underscores the urgency of addressing vulnerabilities in the digital advertising infrastructure to protect users from invisible, zero-click attacks.