Security researcher Chaofan Shou revealed that Kimi K3’s AI model discovered a near zero‑click remote code execution flaw in Telegram’s desktop (Windows/macOS/Linux) and iOS clients, bypassing ASLR and requiring only a crafted data packet, with the exploit just one gadget away from full RCE.
CVE‑2026‑40361 is a high‑severity, use‑after‑free vulnerability in Microsoft Outlook’s preview pane that enables remote code execution without any user interaction; the flaw, rated 8.4 CVSS and marked “Exploitation More Likely,” affects multiple Office versions and can be mitigated by immediate patching, disabling the preview pane, registry hardening, and layered email‑gateway and endpoint defenses.
Google’s May 2026 Android security bulletin disclosed CVE‑2026‑0073, a critical zero‑click authentication bypass in the adbd daemon that lets any attacker on the same LAN bypass wireless ADB’s TLS verification and obtain a shell on unpatched Android 14‑16 devices, with detailed exploitation steps and mitigation guidance.
Security researchers uncovered a CVSS 9.8 zero‑click vulnerability in Telegram that lets attackers execute code and fully control Android and Linux devices by sending a specially crafted animated sticker, and the flaw has been patched but requires immediate user updates.
