InfoSecBulletin Cybersecurity for mankind
Google released security updates for September 2025, fixing 120 security flaws in Android, including two vulnerabilities actively exploited in targeted attacks.
The vulnerabilities are listed below:
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
CVE-2025-38352 (CVSS score: 7.4): A privilege escalation flaw in the Linux Kernel component
CVE-2025-48543 (CVSS score: N/A): A privilege escalation flaw in the Android Runtime component
Google stated that both vulnerabilities can cause local privilege escalation without needing extra execution privileges. Additionally, they highlighted that no user interaction is necessary for exploitation.
The tech giant did not reveal how the issues have been weaponized in real-world attacks and if they are being put to use in tandem, but acknowledged there are indications of “limited, targeted exploitation.”
Benoît Sevens of Google’s Threat Analysis Group (TAG) has been credited with discovering and reporting the upstream Linux Kernel flaw, indicating that it may have been abused as part of targeted spyware attacks.
Google has fixed several vulnerabilities in Framework and System components, including remote code execution, privilege escalation, information disclosure, and denial-of-service issues.
Google released two security patches, 2025-09-01 and 2025-09-05, to help Android partners fix vulnerabilities quickly across devices.
“Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level,” Google said.
