Signal Check

This episode digs into three critical vulnerabilities shaking up the security landscape: a Windows certificate authority flaw that turns standard users into domain admins, a GitHub Actions injection bug in Snowflake's repo that executes commands through issue forms, and an Android kernel exploit delivered via video calls on Unisoc-powered devices. Adrian breaks down how trusted infrastructure keeps becoming the attack surface we forgot to secure. Stories covered: - Certighost and the Privilege Hiding in Your Certificate Authority (BleepingComputer) - https://www.bleepingcomputer.com/news/security/certighost-and-the-privilege-hiding-in-your-certificate-authority/ - Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection (The Hacker News) - https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html - Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access (The Hacker News) - https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html - 4 Signs More Mileage Is No Longer Helping Your Training—And What to Do About It (Runner's World) - https://www.runnersworld.com/training/a73435325/running-mileage-limit/ - The Moon's shadow raced across the heart of Spain, and I was there to see it (Ars Technica) - https://arstechnica.com/space/2026/08/the-moons-shadow-raced-across-the-heart-of-spain-and-i-was-there-to-see-it/ - 'Buy Now, Pay Later' Lenders Pitch Loans for Needs Like Electricity and Rent (Hacker News) - https://www.nytimes.com/2026/08/17/business/buy-now-pay-later.html