Google’s Project Zero discovered a zero-click exploit in Pixel 10 phones, while recent security disclosures highlight critical vulnerabilities across Linux kernels, NGINX servers, and major government infrastructure.

Key Points

• Project Zero identified a memory access vulnerability in the Pixel 10 Tensor G5 chip, allowing remote-to-kernel escalation.
• GitHub suffered an internal repository breach after a developer’s credentials were stolen via a compromised VSCode extension.
• A CISA contractor accidentally exposed sensitive AWS GovCloud credentials and internal passwords in a public GitHub repository.
• The Linux kernel is removing complex zero-copy code from AF_ALG to mitigate recurring memory corruption exploits like CopyFail.
• A Chromium vulnerability, prematurely disclosed by Google, allows malicious JavaScript to maintain persistent background botnet activity in browsers.
• The NGINX "nginx-poolslip" vulnerability currently lacks an official patch, leaving millions of web servers potentially exposed to remote code execution.

Why it Matters

These incidents underscore the growing risks associated with supply chain dependencies and the increasing difficulty of managing security at scale. As organizations and developers rely more on automated tools and third-party integrations, the potential for widespread system compromise through single points of failure continues to rise.