Exploits and vulnerabilities in Q2 2026

Kaspersky Securelist reporting from Q2 2026 through August 2026 covers newly disclosed vulnerabilities and exploits, including open-source AI agents and frameworks; Android malware targeting automotive head units; a HoneyMyte CoolClient backdoor with a kernel-level Windows rootkit; Armored Likho espionage tooling targeting Telegram data; Head Mare exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph; CAV3RN use of Google Apps Script and DNS for covert C2; phishing infrastructures abusing legitimate cloud platforms to bypass MFA; and broader malware trends affecting