ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

This week's ThreatsDay Bulletin covers a range of active cybersecurity threats including exploit chains, Android rootkits, and supply chain attacks.

• •Progress ShareFile has two chained CVEs (CVE-2026-2699, CVE-2026-2701) enabling pre-auth RCE; ~30,000 internet-facing instances are at risk
• •Android rootkit NoVoice spread via 50+ apps with 2.3M downloads, exploiting 22 vulnerabilities to gain root access and inject code into apps like WhatsApp
• •Open-source malware advisories on npm rose ~12x year-over-year in 2025, with attackers targeting high-download packages via account takeover
• •GhostSocks MaaS activity has intensified since late 2025, operating alongside Lumma Stealer to route malicious traffic through residential proxies
• •