Know what changed.
Trace why it matters.

Google said it worked with industry partners to dismantle XCPE, a botnet of more than 1.3 million Android TV set-top boxes whose preinstalled malware rented users’ Internet connections to strangers and conducted advertising fraud. GTIG said Videostrong monetized the backdoor by selling criminal affiliates access and loading their malware modules onto infected devices; Google pursued legal action against domains and servers used to control the botnet.

The same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines and digital signage systems.

INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may permit arbitrary code execution. CVE-2026-16305 involves insecure permissions on execlist.txt: a low-privileged local attacker can modify commands processed by SmartExecute.exe after an update, potentially gaining administrative execution when UAC permits it.

Successful CVE-2026-16305 exploitation may enable arbitrary commands with administrative privileges, while CVE-2026-16306 may enable code execution with the affected user's privileges and use of the workstation as a foothold.

Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber. The vulnerability is identified as CVE-2026-81648 and has a CVSS score of 10.0.

Successful exploitation could allow unauthenticated users to delete arbitrary files on the server and extract additional data; the supplied evidence ends before specifying what could be extracted.