{"id":230585,"date":"2026-04-02T08:45:00","date_gmt":"2026-04-02T12:45:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/02\/pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories\/"},"modified":"2026-04-02T21:25:10","modified_gmt":"2026-04-03T01:25:10","slug":"pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/02\/pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories\/","title":{"rendered":"Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories"},"content":{"rendered":"

Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/threatsday-bulletin-pre-auth-chains.html<\/a><\/p>\n

Publish Date: 2026-04-02 08:45:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Apr 02, 2026<\/span><\/span>Cybersecurity \/ Hacking News<\/span><\/p>\n

The\u00a0latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No\u00a0corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this\u00a0week.<\/p>\n

Things\u00a0are moving fast. The\u00a0list includes researchers chaining small bugs together to create massive backdoors, old software flaws coming back to haunt us, and some very clever new tricks that let attackers bypass security logs entirely without leaving a trace. We\u00a0are also seeing sketchier traffic on the underground and the usual supply chain mess, where one bad piece of code threatens thousands of\u00a0apps.<\/p>\n

It\u00a0is definitely worth a quick scan before you log off for the day, if only to make sure none of this is sitting in your own network. Let’s get into\u00a0it.<\/p>\n

    \n
  1. \n <\/p>\n

    Pre-auth RCE chain exposed<\/span><\/p>\n

    \n watchTower Labs has disclosed two security flaws in Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) that could be chained to achieve pre-authenticated remote code execution. While CVE-2026-2699 is an authentication bypass via the “\/ConfigService\/Admin.aspx” endpoint, CVE-2026-2701 refers to a case of post-authenticated remote code execution. An attacker could combine the two vulnerabilities to sidestep authentication and upload web shells. Progress released fixes for the vulnerabilities with Storage Zone Controller 5.12.4 released on March 10, 2026. There are about 30,000 internet-facing instances, making patching against the flaws crucial.\n <\/p>\n

    \"\"\n<\/li>\n

  2. \n <\/p>\n

    Rootkit spreads via 50+ apps<\/span><\/p>\n

    \n A new Android malware named NoVoice has been distributed via more than 50 apps that were downloaded at least 2.3 million times. While apps masqueraded as utilities, image galleries, and games, and offered the advertised functionality, the malware attempted to obtain root access on the device by exploiting 22 Android vulnerabilities…<\/p>\n<\/li>\n<\/ol>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories https:\/\/thehackernews.com\/2026\/04\/threatsday-bulletin-pre-auth-chains.html Publish Date: 2026-04-02 08:45:00…<\/p>\n","protected":false},"author":1,"featured_media":230586,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEht9hzOUmn8npVxC_AyWUe1DLsv1VkWHox2PmDxZnVuG_XnQt7R5l7CZHlYu9m9BcwAib4L0j0x877sDuCF2shmSH3ef0Me-m0sbKDtu-ZEw5RLqLGNsjGJ0o-b_CuKtFg86fMFb-GKVBud7S8PfpsoL4HCqEZypO1NcWfx6ljXcUhC5O4GIjRbhRcG-fIi\/s1600\/threatsday.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32],"class_list":["post-230585","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230585"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=230585"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230585\/revisions"}],"predecessor-version":[{"id":230587,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230585\/revisions\/230587"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/230586"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=230585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=230585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=230585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}