On September 15 this year, Google published details of patches for 110 vulnerabilities in its own Google Pixel smartphones. Among all the disclosed flaws, CVE-2026-58704 stands out the most, for it appears that this zero-day is being exploited in targeted attacks.

In today’s post, we talk about what’s so special about the Google Pixel, and why these devices get security updates all of their own – separate from regular Android updates. We also cover the vulnerabilities addressed in this latest update, with a special focus on the mentioned, most dangerous one – CVE-2026-58704 – and wrap up with tips on how to both protect your device and avoid becoming a victim of cyberattack on it.

Why do Google Pixel phones get security updates separate from Android?

The reader might reasonably wonder: I’ve already installed this month’s Android security updates on my Google Pixel. Isn’t that the same thing? Google Pixel does run on Android and receives those security updates, which are detailed in the monthly Android Security Bulletin. However, manufacturers of Android-based devices use different sets of hardware and software components. That’s why, alongside vulnerabilities common to all Android devices, there are security issues specific to individual manufacturers’ devices.

For its own smartphones, Google publishes separate security updates, covered by a dedicated Pixel Update Bulletin. Rather than replacing the Android Security Bulletin, this document complements it by detailing vulnerabilities specific to devices manufactured by Google. Other Android smartphones also receive similar updates from their manufacturers.

The Pixel Update Bulletin for September 2026 clearly shows why Google needs separate updates for its smartphones in the first place. Many of the vulnerabilities it fixes affect specific Pixel hardware (or hardware-related) components: the modem, bootloader, GPU, fingerprint scanner components, and other parts of the device. On smartphones from other manufacturers, these features might rely on entirely different hardware and software components, so the fixes listed in the Pixel Update Bulletin don’t apply to those phones.

That said, these vulnerabilities could still be relevant for Pixel owners who’ve flashed their devices with custom ROMs. Switching to a different OS doesn’t alter the device’s hardware components, and may not replace the firmware. Therefore, the vulnerabilities themselves may persist, but whether patches are available, and how they’re installed, depends on the specific OS.

CVE-2026-58704: a zero-day vulnerability being actively exploited in the wild

Now let’s look closer at the specific vulnerabilities Google fixed in September. The most significant one is the above-mentioned CVE-2026-58704.

This vulnerability affects the Cellular Modem component, which handles the smartphone’s communication with cellular networks. It stems from a logic error in the code, which, under certain conditions, allows bypassing the intended permission check.

Successful exploitation of CVE-2026-58704 lets attackers escalate privileges on the smartphone to gain broader access to its functions and data. Note that the attack takes place over a cellular network and the threat actors need low-level privileges on the targeted device to start with.

In practice, this means attackers can’t exploit CVE-2026-58704 to attack a Pixel from just anywhere over the internet, as they’d apparently need to either compromise the cellular network the target smartphone is already connected to or, more likely, force it to connect to a malicious base station under their control.

Google hasn’t disclosed all the details of this vulnerability yet, and the related report is not publicly accessible. As a result, the technical details that would show how easy it is for attackers to exploit CVE-2026-58704 remain unknown pending installation of the patches on all devices.

Nevertheless, Google claims that there are signs of limited exploitation of CVE-2026-58704.

What we know about the other 109 vulnerabilities

Of the remaining 109 vulnerabilities found in Google Pixel devices, only one is rated moderate; the others are either high (62) or outright critical (46). Nine of these flaws fall into the RCE (remote code execution) category. This means that if an attacker successfully exploits one of these vulnerabilities, they can remotely force the device to run malicious code. The exact conditions for the attack depend on the specific vulnerability.

Another 88 vulnerabilities fall into the elevation of privilege (EoP) category. These let an attacker who’s already gained a certain level of access to the device expand their privileges. The CVE-2026-58704 vulnerability discussed above falls into this same category, which is why the September bulletin lists 89 EoP vulnerabilities in total.

Finally, 10 vulnerabilities can lead to information disclosure (ID), and two more to denial of service (DoS). In short, that’s a hefty list of flaws, so Google Pixel owners shouldn’t wait around to install the patches.

How to avoid becoming a victim

Google Pixel owners can install the update that fixes the vulnerabilities covered in this post by following this path: Settings → Security & privacy → System & updates → Security update → Install. Keep in mind that the phone will automatically restart to finish installing the update.

To keep your phone secure we recommend the following general measures:

• Install security updates on your phone regularly and promptly – whether it’s a Google Pixel, an Android smartphone from a different manufacturer, or even an iPhone.
• Avoid installing apps from questionable sources.
• Read reviews before installing apps from official stores, since malware isn’t uncommon there too. Users who have already been burned will often sound the alarm in the reviews long before store moderators get around to removing the dangerous app.
• Install a reliable security solution to keep you from downloading malware, and warn you about suspicious activity on your device.

The number of vulnerabilities detected in code continues to rise. According to Kaspersky’s threat analysis, 5,200 critical vulnerabilities were found in the first half of this year alone — nearly 50% more than during the same period last year. At the same time, the average gap between the publication of information about a vulnerability and the first attempts to exploit it is shrinking. The rapid development of AI systems plays a significant role in this process: while helping companies find weaknesses in their code, AI simultaneously shows hackers how to exploit them quicker.

It would seem that solving the problem of security gaps is very easy. All you need do is set up a scanner, check the infrastructure more often, and update vulnerable systems. But statistics from the Kaspersky Incident Response service show the opposite: a significant number of cyberattacks begin precisely by exploiting a flaw — and these are often already known flaws, not zero-day vulnerabilities.

Using a scanner does not give you an effective vulnerability management process. A scanner merely finds flaws (not always promptly), and then the IT team is tasked with prioritizing and fixing them. These processes can drag on for weeks, and in the meantime an attacker can easily gain access to the given infrastructure.

Where time is lost

The first delay can occur immediately after information about a vulnerability appears in databases. In addition to monitoring for breaches, the information security team is normally handling a dozen-or-so other tasks, so it relies entirely on the scanner for monitoring. If the scanner is configured to run weekly, a new vulnerability will appear in the report in a few days. In a company where scans are conducted quarterly, this obviously happens much later. Attackers, on the other hand, actively monitor news feeds and learn about new vulnerabilities immediately.

When the report finally reaches the security team, it contains far more than just one issue, raising the question of where to start. Critical vulnerabilities are addressed first, but attackers might exploit more than just those. Meanwhile, prioritization decisions are rarely based on data: often, they’re based on the order of the errors in the report, the name of the vulnerable system (they start with the one everyone’s talking about), or increased activity from its owner. Because of this, the risk of overlooking a serious threat is very high. Finally, the IT department takes on the vulnerability, and… it ends up back in the queue: they need to check the update’s compatibility and wait for a maintenance window.

After installing the update, the specialists close the ticket with a clear conscience and mark the status as completed. But would anyone verify that the patch was applied to all affected machines? Even the one that was turned off at the time of installation? Probably not, and then the company would assume the vulnerability was fixed, even though it’ll actually remain in the infrastructure for an indefinite period. This is the worst possible outcome: the risk remains — yet it’s no longer visible.

Put it all together, and what we get is months passing between disclosure and actual resolution. There’s no one in particular to blame here: every participant in the chain did what they’re supposed to. It’s just that this chain itself is made up of links with gaps between them.

A recipe for vulnerability management

To give attackers as few opportunities to gain access to corporate infrastructure as possible, it’s important to ensure that an organization has four key processes clearly established:

1.       Inventory

It’s impossible to verify the security of a system that no one knows exists. At the same time, virtually any large infrastructure will contain things like having had a server set up “for a week” three years ago, a network device left over from previous business owners, or a workstation that was forgotten during an office move. And each of these assets can pose a serious threat.

The goal of inventory management is to ensure complete transparency of the IT infrastructure. To achieve this, an up-to-date list of assets is compiled.

2.       Prioritization

When analyzing vulnerabilities, a security specialist shouldn’t rely solely on ratings from public databases such as the NVD, for these don’t always rely the real severity of the actual potential damage caused by exploiting a vulnerability. The specific structure of an organization’s infrastructure will have a significant impact. For example, the same vulnerability in a server located in an isolated segment, and in a system accessible from the internet, represents two very different risks.

Effective prioritization takes into account not only the publicly reported severity level but also the role of the vulnerable asset within the infrastructure, the likelihood of exploitation, and actual attack trends.

3.       Configuration settings

Overly permissive access settings, disabled security mechanisms, and default accounts are not technically vulnerabilities, but they often serve as entry points for cybercriminals. To prevent an attacker from exploiting inadequate configuration settings, security teams should follow several basic security best practices:

• delete default accounts;
• use strong passwords and MFA;
• disable unused services;
• apply the principle of least privilege.

4.       Confirmation

Blind spots are particularly common at the last stage of the vulnerability management process. Typically, once the IT department formally installs an update, the vulnerability is considered patched. However, before breathing a final sigh of relief, it’s important to at least verify that the patch has been successfully applied to all affected systems and has actually resolved the vulnerability.

Five tasks — one solution

Our solution, the Kaspersky Vulnerability Management module for Kaspersky Next Optimum helps information security specialists establish centralized management of vulnerabilities, assets, and configuration errors. The product solves five key tasks:

• It reduces the time between publication of vulnerability data and its detection in assets. The product automatically inventories the infrastructure — tracking even long-forgotten assets — and continuously scans it for vulnerabilities. Scanning is performed in two ways: agent-based and agentless. In the former, the solution runs on top of Kaspersky Endpoint Security, which allows for in-depth analysis of workstations and servers without transmitting service credentials over the network. In the latter, it analyzes ports and services where no agent is present. Both methods complement each other, enabling complete coverage of the company’s infrastructure.
• Checks configurations. Compliance with security standards is verified using predefined profiles.
• Prioritizes vulnerabilities. Priorities are assigned based on severity level, the characteristics of the specific asset, likelihood of exploitation, and other parameters.
• Promptly fixes errors. This involves remediation recommendations and centralized patch management integrated into the familiar administration infrastructure.
• Helps ensure that the vulnerability is fully patched. A remediation task is considered complete only after a follow-up verification.

The Kaspersky Vulnerability Management Module helps transform vulnerability management from a series of disjointed actions into a well-thought-out cycle. Details about licensing can be found on the Kaspersky Next Optimum for small and mid-sized businesses offering page and more about Vulnerability Management Module — on the module's home page.

You can find plenty of stories online from students in technical fields sharing their worries about school and their career path. One computer engineering student complained about the lack of hands-on experience, saying he was so used to learning theory that he had no idea how to apply it at work. Another student, a sophomore in mechanical engineering, worried that he hadn’t picked up any of the practical skills employers actually want, and joking that McDonald’s is the only place he’ll be able to get a job.

Students, especially those at technical universities, often don’t see the practical value in what they’re learning. As a result, many don’t know what to do next or how to find a job. Here’s a look at where that anxiety comes from, what steps can help overcome it, and why knowing the basics of cybersecurity can come in handy for anyone starting out in a technical field.

Where the anxiety comes from, and what to do about it

The most important thing to know about the fear of not living up to your potential is that it’s completely normal to feel it. American clinical psychologist, Meg Jay, in her book The Defining Decade: Why Your Twenties Matter — And How to Make the Most of Them Now, argues that the years between 20 and 30 are some of the toughest. A person not only runs into their first, often unsuccessful, work experiences and makes bad decisions (“many firsts and worsts”), but also feels unsure of themselves. Reasons may vary. For example, according to Harvard’s Making Caring Common project, 34% of young people aged 18–25 reported feeling lonely, while 58% said they felt their lives lacked “meaning or purpose”. Half of respondents said not knowing what to do with their lives was hurting their mental wellbeing.

That said, Meg Jay writes that this decade plays a key role, since it’s when people make 80% of their major life decisions. According to the psychologist, many young people believe they need to work out what to do with their lives before they can start taking action. Jay, however, disagrees with this approach. She offers the concept of identity capital: the combination of education, work experience, skills, and connections that makes young people valuable professionals. Even without full confidence in a career choice, taking small steps like applying for an internship or taking an extra course can help build a meaningful path for professional growth. On top of that, it’s important for young people to figure out what they enjoy doing, what they’re good at, what the world needs, and, of course, what people are willing to pay them for.

Which skills are sure to come in handy

The concept of identity capital is especially relevant for students in technical fields. According to the World Economic Forum, an average of 39% of workers’ current skills will be transformed or become outdated by 2030. That’s why one should not only stick to one’s chosen field of study, but also build skills in adjacent fields. The same report highlights fast-growing areas like AI, big data, computer literacy, and cybersecurity. Cybersecurity, among others, has its own advantages.

Experts note that the digital landscape is changing rapidly, and cybercriminals are taking advantage of this. Indeed, a recent study of ours found that more than half (56%) of internet users encountered scams or phishing over the past year, and the attacks themselves have become more frequent. In 2025, Kaspersky solutions detected an average of half-a-million new malicious files per day, which is 7% more than the year before.

Human error remains a leading cause of security incidents. For this reason, employers want to make sure all their staff have at least a basic knowledge of cybersecurity: it lowers risk and reduces the cost of dealing with incidents. Knowing the basics of cybersecurity is becoming not just a competitive advantage, but also an integral part of training for professionals in every technical field.

For students, a basic understanding of cybersecurity opens the door to professional development in a wide range of consulting roles. Such professions are quite widespread — especially among young professionals with modest work experience. Against the backdrop of an acute shortage of cybersecurity professionals, these consulting services are in high demand, which is a good sign for graduates with some level of cybersecurity in their background.

The cybersecurity knowledge and practical skills of the specialists of the future are of great importance for their potential employers. For these businesses, a cyber-savvy workforce reduces the need for expensive third-party cybersecurity consultants. Even professionals who lack dedicated technical training but have reasonable digital literacy can significantly reduce the risks of security incidents — in particular in cases involving human error.

Pavel Laskov, Professor for Data and Application Security at the University of Liechtenstein

What’s more, the spread of digital resilience skills benefits not only employers, but also employees themselves: learning the basics of cybersecurity helps develop systems thinking and the ability to see the elements of a structure not as disconnected objects but as a unified whole. It also allows professionals to work across different roles and protect their personal and work data from scammers.

With that in mind, a logical step toward building your identity capital could be Kaspersky Academy’s free online course Cybersecurity. Entry Level. The course is designed for first and second-year students at colleges and universities. It helps them understand what cybersecurity is, what tools cybercriminals use, what fields and specialties information-security professionals work in, and what the future holds for the industry and those working in it.

The program was recently expanded with a new module, Security by Design, which covers information-security architecture and design of inherently secure systems.

Kaspersky’s leading experts cover every topic in the course in plain, easy-to-follow language with examples, so students get a comprehensive view of cybersecurity straight from practitioners. The course lasts one month, and students who pass the final test receive a Kaspersky Academy certificate.

The main goal of the course is to raise students’ awareness of cybersecurity, and teach them how to protect themselves against the most common types of cyber-incidents. During the course, students will gain knowledge and skills that will serve them well — no matter what field of study they choose.

The course is available as video lessons on the Kaspersky Academy learning platform. To get access to the course, submit a request on the program’s website providing your academic email address (with a university or college domain).

Educational institutions can easily integrate the course into their curriculum: it’s available in SCORM — a standard e-learning format — to institutions that join our Kaspersky Academy Alliance partner program.