Mobil va simsiz aloqa
Android’ning 2026-yil noyabr yangilanishlari 200 dan ortiq zaiflikni tuzatdi
Eng jiddiy zaiflik — Framework’dagi muhim kamchilik bo‘lib, u foydalanuvchi bilan o‘zaro aloqasiz masofadan kod bajarishga olib kelishi mumkin.
Muallif: Ionut Arghire
3-noyabr 2026-yil (ET vaqti bilan 8:21)
Dushanba kuni Google Android uchun yangi xavfsizlik yangilanishlarini e’lon qildi, ular 200 dan ortiq zaiflikni, jumladan, ikki o‘nlab muhim darajadagi muammolarni bartaraf etadi.
Yangilanishlarning birinchi qismi qurilmalarga 2026-11-01 xavfsizlik yamoq darajasi sifatida yetib keladi va Android runtime, Framework va System bo‘yicha 119 ta xavfsizlik nuqsonini tuzatadi.
Framework eng ko‘p — 65 ta, System esa 53 ta tuzatish oldi. Google Android runtime’dagi yuqori darajadagi ma’lumot oshkor qilish xatosini ham bartaraf etdi.
Google xavfsizlik byulleteniga ko‘ra, tuzatilgan zaifliklar orasida eng jiddiyi Framework komponentida joylashgan va CVE-2026-58868 sifatida kuzatiladi.
"Bu muammolar orasida eng jiddiyi — Framework komponentidagi muhim xavfsizlik zaifligi bo‘lib, u qo‘shimcha bajarish huquqlarisiz masofadan kod bajarishga olib kelishi mumkin. Foydalanuvchi bilan o‘zaro aloqa ekspluatatsiya uchun talab qilinmaydi", — deb ta’kidlaydi kompaniya.
System komponentida ham muhim darajadagi masofadan kod bajarish (RCE), huquqlarni oshirish (EoP) va xizmatdan voz kechish (DoS) zaifliklari tuzatildi.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
Google bu kamchiliklardan 17 tasini oylik yangilanishdan oldin, Google Play tizim yangilanishlari doirasida tarqatdi.
Android’ning 2026-yil noyabr xavfsizlik yangilanishlarining ikkinchi qismi qurilmalarga 2026-11-05 xavfsizlik yamoq darajasi sifatida yetib keladi va Kernel, Arm, Imagination Technologies, MediaTek, Unisoc va Qualcomm komponentlaridagi 97 ta xatoni tuzatadi.
Ko‘pchilik tuzatishlar yuqori darajadagi muammolarga qaratilgan bo‘lsa-da, o‘nlabdan ortiq tuzatish Bluetooth, pKVM, HID, MediaTek modem va Qualcomm yopiq manba komponenti kabi kichik komponentlardagi muhim darajadagi zaifliklarni bartaraf etadi.
"2026-11-05 yoki undan yuqori xavfsizlik yamoq darajalari bu muammolarning barchasini qamrab oladi", — deb qayd etadi Google.
Dushanba kuni Google Android XR va Wear OS uchun ham xavfsizlik byulletenlarini e’lon qildi. 2026-yil noyabr Android byulletenida tasvirlangan xatolardan tashqari, Android XR yangilanishi Framework’dagi yuqori darajadagi zaiflikni, Wear OS yamoqi esa Framework va System’dagi ikkita yuqori darajadagi muammoni tuzatadi.
Bog‘liq: Google 1,3 million Android qurilmasidan iborat XCPE botnetini yo‘q qildi
Bog‘liq: Google $250 000 miqdoridagi Root-in-Cloud xato mukofotini joriy etdi
Bog‘liq: Maksimal darajadagi GitLab zaifligi Alpine Linux’ga qarshi hujumlarda ekspluatatsiya qilinmoqda
Bog‘liq: Android’ning 2026-yil oktyabr yangilanishlari 25 ta zaiflikni tuzatdi
Yozgan: Ionut Arghire
Ionut Arghire — SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
Eng so‘nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlaridan xabardor bo‘lish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Ionut Arghiredan ko‘proq
- Google $250 000 miqdoridagi Root-in-Cloud xato mukofotini joriy etdi
- Zararli Claude Code kengaytmasi Cursor ta’minot zanjiriga hujumda tarqatildi
- Chainalysis AI asosidagi kiberhujumdan so‘ng ma’lumotlar buzilishini oshkor qildi
- PHP2Shell hujumlari Palo Alto Firewalls’ni ildizdan buzdi, lekin WordPress’ga qarshi muvaffaqiyatsiz bo‘ldi
- Bulletproof Host Virtualine domenini FBI musodara qilishiga yo‘qotdi
- Yangi WordPress zaifligi hujumchilarning diqqat markazida
- Maksimal darajadagi GitLab zaifligi Alpine Linux’ga qarshi hujumlarda ekspluatatsiya qilinmoqda
- TeamViewer xatosi zararli xostlarga qo‘llab-quvvatlash texniklarining mashinalarini egallashga imkon berishi mumkin
So‘nggi yangiliklar
- Muhim Node-RED zaifligi hujumlarda ekspluatatsiya qilinmoqda
- Buyuk Britaniya kiber rahbari 2028-yilga qadar Buyuk Britaniya muhim infratuzilmasiga AI kiberhujumlari bo‘lishini aytdi
- Google 1,3 million Android qurilmasidan iborat XCPE botnetini yo‘q qildi
- NATO’ning Crossed Swords mashqi AI agentlarini kiberoperatsiyalar o‘quviga jalb qildi
- 100 dan ortiq Yevropa do‘konlari supermarket muzlatgich hujumlari qaytishi bilan zararlangan
- Kiberxavfsizlik M&A hisobot: 2026-yil oktyabrda 37 ta bitim e’lon qilindi
- Florida talaba yordami veb-sayti xakerlikka uchrab, 4,9 million kishining ma’lumotlari xavf ostida qoldi
- Revolve ma’lumotlar buzilishi kamida 200 000 kishiga ta’sir qildi
Trendda
Zararli Claude Code kengaytmasi Cursor ta’minot zanjiriga hujumda tarqatildi
FBI Shimoliy Koreyaning Binance o‘g‘irligiga bog‘liq 600 dan ortiq manzilni aniqladi
Ivanti Connect Secure hujum zanjirida ekspluatatsiya qilinayotgan yana ikkita nol-kun zaifligini tuzatdi
PHP2Shell hujumlari Palo Alto Firewalls’ni ildizdan buzdi, lekin WordPress’ga qarshi muvaffaqiyatsiz bo‘ldi
Northstar Security $7 million bilan zaharli xavf kombinatsiyalarini ochish uchun yashirin rejimdan chiqdi
Kiberxavfsizlik M&A hisobot: 2026-yil oktyabrda 37 ta bitim e’lon qilindi
Revolve ma’lumotlar buzilishi kamida 200 000 kishiga ta’sir qildi
Google $250 000 miqdoridagi Root-in-Cloud xato mukofotini joriy etdi
Kundalik axborot byulleteni
Eng so‘nggi tahdidlar, tendensiyalar va texnologiyalardan xabardor bo‘lish, shuningdek, soha mutaxassislarining chuqur fikrlaridan foydalanish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Vebinar: CTEM dasturi uchun kuchliroq agentik pentesting
4-noyabr 2026-yil
Pentestlar orasidagi xavfsizlik bo‘shliqlarini yoping. Ushbu sessiyada agentik pentestingni o‘rganing va CTEM dasturingizda uzluksiz ta’sirni tekshirish uchun amaliy asosga ega bo‘ling.
Ro‘yxatdan o‘ting
Virtual tadbir: CISO Forum 2026 Summit
10 va 11-noyabr 2026-yil
CISO’lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini bir joyga to‘plab, korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni amaliy tajriba bilan o‘rganamiz.
Ro‘yxatdan o‘ting
Harakatdagi odamlar
Barracuda Dan Fletcher’ni CFO etib tayinladi.
Artemis Security Arun Singh’ni CGO etib tayinladi.
General Paul M. Nakasone Armadin direktorlar kengashiga qo‘shildi.
Harakatdagi ko‘proq odamlar
Mutaxassis fikrlari
Passkeys parollardan yaxshiroq. Lekin ular yetarli emas.
Tashkilotlar parollarni yo‘q qilganda, hujumchilar moslashadi. Autentifikatorga to‘g‘ridan-to‘g‘ri hujum qilish o‘rniga, ular uning atrofidagi imkoniyatlarni qidiradi. (Torsten George)
Xavf shaxsiy bo‘lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o‘rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, uzilishlarga tayyorlanish va noaniqlik sharoitida qiyin qarorlar qabul qilishga o‘rgatilgan. Ammo bu intizom tizim yoki korxona emas, balki siz bo‘lganingizda boshqacha ko‘rinadi. (Steve Durbin)
Hech kim xavfsizlik so‘rovnomasiga ishonmaydi. Shunga qaramay, biz unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — yuboruvchining o‘zi ishonmaydigan va qabul qiluvchi qabul qiladigan o‘z-o‘zini baholash. Nihoyat, kompaniyalar o‘rtasida ishonch uchun yaxshiroq asos paydo bo‘ldi. (Sravish Sridhar)
Bu normal: NetScaler nol-kun zaifliklari bizga yangi normal haqida nimani aytadi
Yaqin orada Citrix NetScaler yamoqlari yana bir turkumda chiqarilishi mumkin, shuning uchun yamoqni boshqarish quvurlaringizni tayyor saqlang. (Tod Beardsley)
AI dasturiy ta’minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir qiladi. (Matias Madou)
Mobile & Wireless
Android’s November 2026 Updates Patch Over 200 Vulnerabilities
The most severe is a critical flaw in Framework leading to remote code execution without user interaction.
By
Ionut Arghire
| November 3, 2026 (8:21 AM ET)
*
Google on Monday announced new security updates for Android that resolve more than 200 vulnerabilities, including two dozen critical-severity issues.
The first part of the patches arrives on devices as the 2026-11-01 security patch level and resolves 119 security defects across Android runtime, Framework, and System.
Framework received fixes for the largest number of flaws, namely 65, followed by System with 53. Google resolved one high-severity information disclosure bug in Android runtime.
According to Google’s security bulletin, the most severe of the patched weaknesses resides in the Framework component and is tracked as CVE-2026-58868.
“The most severe of these issues is a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation,” the company says.
Critical-severity remote code execution (RCE), elevation of privilege (EoP), and denial-of-service (DoS) vulnerabilities were addressed in the System component as well.
Advertisement. Scroll to continue reading.
Google rolled out patches for 17 of these flaws ahead of the monthly rollout, as part of Google Play system updates.
The second part of Android’s November 2026 security updates arrives on devices as the 2026-11-05 security patch level and fixes 97 bugs in Kernel, Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components.
While most of the fixes target high-severity issues, more than a dozen of them resolve critical-severity weaknesses in subcomponents such as Bluetooth, pKVM, HID, MediaTek modem, and a Qualcomm closed-source component.
“Security patch levels of 2026-11-05 or later address all of these issues,” Google notes.
On Monday, Google also published security bulletins for Android XR and Wear OS. In addition to the bugs described in the November 2026 Android bulletin, the Android XR update resolves a high-severity flaw in Framework, while the Wear OS patch addresses two high-severity issues in Framework and System.
Related:Google Dismantles XCPE Botnet of 1.3 Million Android Devices
Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
Related:Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related:Android’s October 2026 Updates Patch 25 Vulnerabilities
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack
- Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
- Fresh WordPress Vulnerability in Attackers’ Crosshairs
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
Latest News
- Critical Node-RED Flaw Exploited in Attacks
- UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices
- NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training
- Over 100 European Stores Hit as Supermarket Fridge Attacks Return
- Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
- Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
- Revolve Data Breach Impacts at Least 200,000 People
Trending
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
Revolve Data Breach Impacts at Least 200,000 People
Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
More People On The Move
Expert Insights
*
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)