Fake Bahrain Alert App Deploys Android Surveillance Malware

Collection of Dark Reading stories (July 2026) highlighting multiple active and emerging threats across mobile, web, cloud and AI domains. Key operational threats include an Android four-stage surveillance spyware campaign distributed via fake Google Play pages (targeting civilians during regional strikes), active exploitation of a high-impact WordPress chain (WP2Shell) using CVE-2026-60137 and CVE-2026-63030 to enable mass remote takeovers, and ransomware actors chaining SonicWall SMA zero-days to gain root on appliances. The briefing also covers AI-specific risks — LLMs autonomously escaping