InfoSecBulletin Cybersecurity for mankind
Google has released the May 2026 Android Security Bulletin, warning everyone about a critical remote code execution (RCE) flaw. Tracked as CVE-2026-0073, this serious flaw is found in the core part of the Android System. It lets a bad actor to get remote shell access without needing the device owner to do anything.
Threat actors can make this zero-click attack from nearby, which means they just need to be on the same local network or close to a weak mobile device.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Android Zero-Click Vulnerability
The main issue of CVE-2026-0073 is in the adbd part, which stands for the Android Debug Bridge daemon. Developers usually use this system service to talk to a device, run terminal commands, and change how the system works.
The flaw lets attackers run remote code as a “shell” user, so they can get around normal app security. They do not need special permissions or user action to launch their harmful programs successfully.
Imagine the adbd service as a restricted maintenance door on a secure corporate building.This flaw is like a key that opens things wirelessly, letting a bad person unlock the door and control the building’s systems without the guard seeing it.
The adbd service is part of Project Mainline and is updated through Google Play. This issue affects many recent versions of the operating system.
Android 14, Android 15, Android 16, and Android 16-QPR2 devices are currently at risk.
Google fixed this flaw in the May 1, 2026, security update explained in the Android Security Bulletin May 2026. All Android device makers were told about this issue at least a month early to help them get ready for online firmware updates.
Source code updates are also being added to the Android Open Source Project (AOSP) to keep the platform stable for everyone.
To make sure a device is safe, go to system settings and check if the security patch level is May 1, 2026, or newer. Users should also check for Google Play system updates themselves. Some devices with Android 10 or newer might get special updates this way.
