A medium severity vulnerability (CVE-2026-64155) in the Linux kernel's ath11k WiFi driver was fixed. The issue involved error path leaks in some WMI Wake on Wireless (WOW) calls due to failure to free skb buffers on error paths. This could lead to resource leaks affecting system availability.
CVE-2026-63866 is a high-severity vulnerability in the Linux kernel's mt76 wireless driver for the mt7996 chipset. The flaw involves improper handling of the WCID pointer during the deinitialization of a station link in the mt7996_mac_sta_deinit_link() function. This issue has been resolved by clearing the WCID pointer when removing the station link.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.
The RedHook Android malware has evolved to abuse the Android Wireless Debugging (Wireless ADB) feature to gain shell-level privileges without requiring a computer connection or device rooting. It tricks users into granting Accessibility permissions to enable Developer Options and Wireless Debugging, then uses the pairing code to connect to the local ADB service. This grants it UID 2000 shell privileges, allowing it to execute privileged commands, install or uninstall apps silently, capture screen content, simulate user input, and more. The malware employs multiple persistence mechanisms to maintain its presence and is distributed via social engineering campaigns impersonating government or financial institutions. Android users are advised to install apps only from Google Play and scrutinize permissions carefully.
RedHook is an Android Remote Access Trojan that has re-emerged with significant enhancements, particularly in privilege abuse capabilities. The malware autonomously exploits Android's ADB Wireless Debugging features to obtain shell-level access, integrating the Shizuku framework to execute protected system APIs. Recent activity shows expansion beyond Vietnam to Indonesia, targeting Southeast Asian users through spoofed government and financial websites. Malicious APKs are hosted on trusted platforms like AWS S3 and GitHub repositories. The current version supports 53 distinct server-issued commands and employs sophisticated persistence mechanisms including foreground activity spoofing, silent media playback, and cross-process monitoring. Distribution relies on social engineering via phone calls and messaging applications, tricking victims into downloading malicious APKs and enabling Accessibility services under false pretenses.
In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.
A vulnerability in the Linux kernel's mt76 wireless driver for mt7921 hardware caused firmware crashes when a station was configured with an AID (Association ID) over 20 on AP interfaces. This issue arose from a modified hostapd allocating AIDs starting at 65, which is outside the expected range. The fix places an upper limit on station AIDs to prevent firmware crashes but does not support AIDs above 20. The issue does not affect station mode interfaces.
A vulnerability in the Linux kernel's Broadcom wireless driver (brcmfmac) was identified and resolved. The function brcmf_chip_add_core() can return an error pointer that was not properly checked before dereferencing, leading to a potential null pointer dereference. This issue was detected by static analysis and fixed by adding the necessary error pointer checks. The vulnerability affects the availability of the system but does not impact confidentiality or integrity.
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London , the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider , and their guilty pleas came on the first day of what was expected to be a six-week trial. Owen Flowers (left) 18, and Thalha Jubair, 20. Image: UK National Crime Agency (NCA). Thalha Jubair , 20, of East London and 18-year-old Owen Flowers of Walsall admitted conspiring to commit unauthorized acts against Transport for London computer systems and causing risk of serious damage to human welfare. According to a report from the BBC, Flowers alone admitted to being part of a conspiracy to hack into U.S. based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024. Jubair is also wanted by U.S. law enforcement agencies. In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering in relation to 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025, and that the group’s victims paid at least $115 million in ransom payments. In July 2025, KrebsOnSecurity reported that Flowers and Jubair were arrested in the United Kingdom in connection with Scattered Spider ransom attacks against the retailers Marks & Spencer and Harrods , and the British food retailer Co-op Group . Multiple sources familiar with those investigations said Flowers was the Scattered Spider member who anonymously gave interviews to the media in the days after the group’s September 2023 ransomware attacks disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Entertainment . According to prosecutors, Jubair co-ran a bustling Telegram channel called Star Chat , the home of a SIM-swapping group that used voice- and SMS-based phishing attacks to steal credentials from employees at the major wireless providers in the U.S. and U.K. The group would then use that access to sell a service that could redirect a target’s phone number to a device the attackers controlled and intercept the victim’s calls and text messages (including one-time codes for multi-factor authentication). A receipt from Star Fraud Chat’s SIM-swapping service targeting a T-Mobile customer after the group gained access to internal T-Mobile employee tools. “Rocket Ace” was one of Jubair’s hacker handles, according to U.S. prosecutors. New Jersey prosecutors also allege Jubair also was involved in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from employees at hundreds of companies. That weeks-long SMS phishing campaign led to intrusions and data thefts at more than 130 organizations, including LastPass , DoorDash , Mailchimp , Plex and Signal . KrebsOnSecurity reported last year that one of Jubair’s alter egos at age 15 was “ Everlynn ,” a hacker who sold fraudulent “emergency data requests” that used compromised police and government email addresses to demand subscriber data (e.g. username, IP/email address) from major tech companies, claiming the requests concerned urgent matters of life and death and could not wait for a court order. In April 2026, 24-year-old British national and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022. The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States. Buchanan is currently scheduled to be sentenced on October 2. In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael Urban was sentenced to 10 years in…
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell command string passed to rut_doSystemAction without sanitization to achieve full root-level command execution on the underlying operating system.
MESH is an open-source remote mobile forensics tool designed to enable encrypted, peer-to-peer wireless debugging and forensic data acquisition on mobile devices, particularly Android. It creates a censorship-resistant mesh network that overcomes NAT and firewall restrictions without exposing devices to the public internet. The tool supports integration with common forensic utilities and includes network monitoring capabilities. MESH is currently in public alpha, actively developed, and has undergone penetration testing with major vulnerabilities patched. It is intended for use in high-risk or censored environments and emphasizes transient, analyst-controlled forensic sessions rather than permanent infrastructure.
This content is a free educational resource providing courses and PDFs on WiFi hacking techniques, including foundational wireless attacks against common Wi-Fi protocols such as WEP, WPS, and WPA2. It covers penetration testing disciplines and tools used in wireless security assessments. The material is intended for learning both offensive and defensive cybersecurity concepts and is not itself a vulnerability or exploit.
BruceButBetter is an open-source DIY hardware project that replicates Flipper Zero functionality on an ESP32-S3 platform. It includes multiple radio and signal capabilities such as Sub-GHz, NFC/RFID, 2.4 GHz wireless protocols, IR, WiFi, BLE attacks, and a signal generator. The project is intended as a red-team multitool for authorized testing and education. It is publicly available on GitHub with build guides and prebuilt firmware images.
A high-severity vulnerability (CVE-2025-20701) in the Beats Studio Buds wireless earbuds allowed nearby attackers to pair without user consent and listen through the microphone. The flaw was due to incorrect authorization in the Airoha Bluetooth audio SDK. Apple addressed the issue in Beats Firmware Update 1B211. Exploitation requires only Bluetooth range proximity and no user interaction. This vulnerability was publicly disclosed in June 2025 alongside related flaws in Airoha SoCs. Similar patches were issued by other vendors like Jabra. The flaw enables remote escalation of privilege and potential eavesdropping.
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside Japan); Refrigerators (for Japan); Heat Pump Water Heaters / HEMS-Compatible Adapters / Wireless LAN Adapters (for Japan); Bathroom Dryer / Heater / Ventilation Systems (for Japan); Adapters for Airflow Ventilation Systems, Heat Pump Chilled / Hot Water Systems, and Ventilation / Air-Conditioning System Air Resorts (for Japan); Lossnay Central Ventilation Systems (for Japan); Smart Switches for Ventilation Fans and Lossnay (for Japan); IH Cooking Heaters (for Japan); and Rice Cookers (for Japan) allows an attacker within Wi-Fi radio range of an affected product to access the affected product using a hard-coded SSID and password, thereby obtaining device data such as operation status, room set temperature, and room temperature; changing the air-conditioner or Wi-Fi settings; or causing Wi-Fi communication to enter a denial-of-service (DoS) condition.
A security update for the Red Hat Enterprise Linux Real Time kernel (kernel-rt) addresses multiple vulnerabilities affecting various kernel components including networking, IPv6, crypto, I/O memory management, file systems, and wireless subsystems. The update fixes issues such as use-after-free, out-of-bounds reads, overflow, and improper validation that could impact system stability and security. The update requires a system reboot to take effect.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.
