FlagThis — Daily Cybersecurity Intelligence Briefing

In late 2026, Citizen Lab identified a zero‑click spyware campaign whereby the Israeli mercenary vendor Candiru delivered its surveillance implant through malicious online advertisements served by the ad‑tech intermediary Discover‑Tech via its ‘AdFection’ technique. The exploit leveraged a browser rendering vulnerability (likely a use‑after‑free in Skia) to achieve remote code execution on ad load, requiring no user interaction. Targets included journalists and staff at Al Jazeera, enabling exfiltration of SMS, call logs, microphone, camera, and location data via HTTPS C2 to cloud‑fronted domains. The incident demonstrates scalable, stealthy mercenary spyware distribution via legitimate ad ecosystems.

The discovery of "Plugin4Shell" and associated LangGraph vulnerability chains introduces a critical zero-click Remote Code Execution (RCE) vector targeting AI-driven development environments. By exploiting plugin marketplaces and orchestration logic, attackers inject malicious instructions into plugin metadata or retrieved grounding context. This triggers semantic integrity failures and agentic memory exploitation, enabling CVE-2026-35603 privilege escalation. The vulnerability allows adversaries to hijack the full permissions of developers within GitHub Copilot, Claude Code, and Gemini CLI, facilitating unauthorized access to proprietary source code, corporate credentials, and internal enterprise systems through autonomous, unintended tool execution.

CVE-2024-38063 is a critical remote code execution (RCE) vulnerability within the Microsoft Windows TCP/IP driver (tcpip.sys). The flaw is triggered by specially crafted IPv6 packets containing malformed Hop-by-Hop extension headers, leading to an integer/buffer overflow during packet processing. Because the vulnerability resides at the kernel level and requires no user interaction, it allows unauthenticated attackers to achieve SYSTEM-level code execution. This zero-click vector enables potential wormable exploitation across IPv6-enabled networks, posing a severe risk of full system compromise, lateral movement, and data exfiltration. Immediate application of Microsoft's August 2024 security updates is mandatory to remediate the driver flaw.