Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack

This collection of CyberScoop stories highlights multiple high-risk developments: researchers traced a Coruna iOS exploit kit—possibly built from a leaked U.S. framework—used in the first known mass iOS attack and observed moving between a spyware vendor’s customer, Russian actors, and Chinese cybercriminals. Security teams also disclosed agentic AI browser flaws (e.g., Comet/Zenity) that can be triggered via simple invites to access local files, enumerate directories, and exfiltrate data. Google shipped a large March 2026 Android security update that includes a recently actively exploited, on