The article documents a zero-click-to-root exploit chain on Pixel 10: an updated Dolby decoder exploit (CVE-2025-54957) paired with a new VPU kernel driver flaw whose mmap handler maps unbounded physical memory, exposing the kernel image. The author credits Android's improved triage (High severity rating, 71-day fix) but argues the same vendor again shipped a shallow, easily found driver bug, so proactive driver security remains weak.
Cloudflare details four malicious JavaScript campaigns found on storefronts—affiliate-commission hijacking, clickless affiliate theft, a remote-code backdoor, and a paid-traffic cloaker—that VirusTotal and URLScan largely missed, arguing behavioral ML analysis beats signature scanning for gated, conditionally executing scripts. The detection pipeline combines a graph neural network, a lightweight LLM on Workers AI, and a weighted frontier-model voting ensemble with human review. It is a vendor post promoting Cloudflare Client-Side Security, so evidence is detailed but conclusions favor the product.