Telemetry, Linux Flaws, Ubiquiti Fix, Driver License Breach

Transsion Phones Ship with Telemetry SDK Exfiltrating Data to China

A NowSecure investigation reveals that every smartphone sold by Transsion — the world’s fourth-largest manufacturer, with brands TECNO, Infinix, and itel dominating Africa, South Asia, Southeast Asia, and Latin America — ships with a proprietary Android telemetry framework. The SDK, called Athena and oneID, reports encrypted data to the domain shalltry.com using AES-256 with keys recovered from the client binary: a fixed 16-byte IV and a global table of 64 AES-256 keys stable across devices and SDK versions. Decrypted payloads include GPS coordinates, cell tower lists, the foreground app, camera usage, and per-app network data, all bound to roughly 14 permanent, non-user-resettable identifiers. The SDK is preinstalled as a system component in core apps like com.android.settings, the launcher, and the camera service, and holds powerful permissions including READ_CLIPBOARD_IN_BACKGROUND and READ_PRIVILEGED_PHONE_STATE. It also appears in third-party Android apps with hundreds of millions of downloads, such as Boomplay (100M+), AHA Games (500M+), and Hola Browser (500M+). Uploads go to Alibaba Cloud (eu-central-1) and are fronted by CloudFront. The only effective mitigation is a DNS-level wildcard block of *.shalltry.com (and *.transsion-os.com).

1-in-2 phones sold in Africa exfiltrate telemetry to China - NowSecure →

Januscape Linux KVM Flaw Lets Guest VMs Take Over Host after 16 Years

A high-severity vulnerability in Linux KVM, tracked as CVE-2026-53359 and named Januscape, allows an untrusted guest virtual machine to gain root access to the host machine. The flaw resides in the KVM guest-side shadow MMU emulation and affects both AMD and Intel processors. Researcher Hyunwoo Kim discovered the use-after-free bug, which went unnoticed in the Linux kernel for 16 years. Kim released a proof-of-concept that triggers a host OS crash from within the guest, and stated that a full guest-escape exploit exists but will not be released until ‘the very distant future.’ Google awarded $250,000 for the discovery. The vulnerability enables an attacker to compromise the host kernel, panic the host, and cause denial of service against all other tenant VMs on the same physical machine, or take over the host and all guests.

Google pays $250K for Linux vulnerability allowing guest VM escapes - Ars Technica →

Ubiquiti Patches Maximum-Severity CVE-2026-50746 and Six Other Critical Flaws

Ubiquiti released security updates on July 8, 2026 for seven critical vulnerabilities in UniFi OS, with the most severe — CVE-2026-50746 — carrying a CVSS score of 10.0. The flaw is an Improper Access Control (CWE-284) in the UniFi Connect Application versions 3.4.16 and earlier, allowing unauthenticated command injection. The patch updates the application to version 3.4.20 or later. Censys data shows over 100,000 UniFi OS instances exposed on the internet, nearly 50,000 in the United States. The advisory also patched six additional critical vulnerabilities: CVE-2026-50747 and CVE-2026-50748 (both CVSS 9.9), CVE-2026-54400 (CVSS 9.1, requires high privileges), and others affecting UniFi Talk, UniFi Access, UniFi Protect, UniFi OS Server, routers, gateways, NAS, and surveillance systems. Six of the seven flaws are exploitable with low complexity and no user interaction. Ubiquiti has not disclosed whether the maximum-severity flaw was exploited in the wild before the fixes were released.

Ubiquiti Patches CVE-2026-50746, Maximum-Severity Flaw in UniFi… | DeafNews →

GhostLock Linux Kernel Exploit Grants Root in Five Seconds, Breaks Containers

A public exploit for CVE-2026-43499, named GhostLock, is now available; any logged-in user can gain full root control of an affected machine in roughly five seconds with no special configuration or network access. The flaw has existed in the Linux kernel since version 2.6.39 (May 2011) and affects every mainstream distribution. Nebula Security’s VEGA team disclosed the vulnerability on July 7, 2026, alongside a full writeup and open-source PoC. Google’s kernelCTF bug-bounty program awarded $92,337 for the submission. GhostLock is a use-after-free in the kernel’s real-time mutex priority inheritance subsystem, specifically in the remove_waiter() function on the Requeue-PI proxy path. The exploit breaks out of Docker and Kubernetes containers, making cloud and shared infrastructure high-priority targets. Nebula also demonstrated IonStack, a two-stage attack chaining GhostLock with CVE-2026-10702, a Firefox JIT bug, to achieve full device control from a single malicious link on Android. No confirmed in-the-wild exploitation had been reported as of July 8, 2026. The upstream fix was still settling, and Ubuntu 24.04, 22.04, and 20.04 LTS remained vulnerable or in progress. The vulnerability carries a CVSS score of 7.8 (High), but the container-escape and remote-chain potential raise the actual risk.

Public Exploit Turns 15-Year Linux Kernel Flaw Into 5-Second Root Attack →

AssuranceAmerica Data Breach Exposes Nearly 7 Million Driver’s License Numbers

A data breach at auto and renters insurer AssuranceAmerica compromised the personal information of nearly 7 million individuals, including driver’s license numbers. The company identified suspicious activity on its systems on March 17, likely resulting from threat actors targeting an employee. Unauthorized third parties obtained files containing names, contact information, policy details, vehicle information, and driver’s license numbers. Driver’s license numbers pose a heightened risk of fraud, such as opening financial accounts or creating fake IDs. AssuranceAmerica plans to send breach notices starting July 10. The insurer does not currently appear to be offering credit monitoring or identity theft protection. Recommended precautions include freezing credit, setting up fraud alerts, and monitoring financial accounts. Experian advises running a background check and requesting a driving record to detect fraudulent activity. Individuals may request a new license number from their state DMV if they have a police report or evidence of fraud.

This Massive Data Breach Compromised Nearly 7 Million Driver’s Licenses →