This briefing covers 11 cybersecurity and geopolitics stories published around Monday, August 24, 2026, including activity involving PLA, China, and 9 disclosed vulnerabilities (CVE-2026-10053, CVE-2026-59561, CVE-2026-78168, CVE-2026-78169 and others). Each entry links to the original reporting.
China has modified civilian ferries for armored vehicle launches, hardened air bases, and expanded missile forces targeting U.S. intervention—yet a persistent analytical school argues Taiwan invasion remains beyond PLA reach.
ToxicPanda Android banking malware now abuses VPN permissions to disable Google Play Protect, expanding its target list to 349 apps and supporting 167 remote commands. The capability to blind Google's on-device defense marks a meaningful escalation in mobile banking-fraud infrastructure.
CVE-2026-78212 exposes 4MOSAn Management Center to unauthenticated arbitrary file read via relative path traversal, scoring 8.7 HIGH. No authentication required lowers the exploitation bar for lateral movement against networks running 4MOSAn security infrastructure.
CVE-2026-78169 (CVSS 9.9 CRITICAL) enables remote stack-based buffer overflow via the strcpy function in UTT HiPER 1250GW routers up to firmware 3.2.7-210907-180535; exploit is public. Edge-device RCE with a public PoC and no vendor patch confirmation creates immediate exposure across any network running this hardware.
CVE-2026-78168 allows remote improper authentication against EFM ipTIME T24000M routers up to firmware 14.20.0 via session validation bypass; vendor did not respond to disclosure.
CVE-2026-78170 (CVSS 9.0 HIGH) allows remote buffer overflow via SSID argument manipulation in UTT HiPER 1200GW routers up to firmware 2.5.3-170306; exploit is published. Paired with CVE-2026-78169 on the same vendor's product line, this signals a systematic exposure of UTT edge hardware.
CVE-2026-59561 (CVSS 8.4 HIGH) allows arbitrary OS command execution in Sakura Editor when a victim opens a terminal in an attacker-crafted directory. The user-interaction dependency makes this a credible spearphishing delivery vector targeting Japanese developer and administrative environments.
CVE-2026-78213 (CVSS 8.7 HIGH) enables authenticated attackers to inject persistent JavaScript into Heptabase pages, executing against every subsequent user who clicks crafted content.
CVE-2026-78211 (CVSS 9.8 CRITICAL) allows unauthenticated remote OS command injection through an unremoved ADOdb test page in 4MOSAn GCB Doctor security appliances.
CVE-2026-78207 (CVSS 9.4 CRITICAL) in exceljs through 4.4.0 allows prototype pollution via malicious __proto__ keys in cell note JSON, affecting all plain objects in the process.
CVE-2026-10053 (CVSS 8.5 HIGH) affects GitLab CE/EE versions 18.8 through 19.2.1, allowing authenticated users to achieve remote code execution via path traversal in the package registry; patched in 19.0.6, 19.1.4, and 19.2.2.