Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A technical analysis details how an HTC U11 Plus running older HTC Sense firmware on Android 8 or Android 9 can bypass Factory Reset Protection after a forgotten pattern lock, using only a working SIM card and no PC.
The author first documented numerous failed attempts that included muscle memory recovery, Google account unlinking via web, Find My Device, standard Hard Reset, bootloader unlocking through HTCdev, SIM PIN tricks, and attempts to reach hidden menus through the Help app or intent links. All standard paths remained blocked by the FRP-enforced setup wizard.
The working method begins by accessing the emergency contacts screen during initial setup language selection. A contact from the SIM is added, an email address is inserted into the contact, and the resulting mail icon is used to open the Gmail app. From there the user selects an Exchange account instead of Google, enters manual server settings, and reaches the Client Certificate option.
Selecting the certificate triggers a system prompt to set a screen lock. Choosing the combined fingerprint and PIN option bypasses the grayed-out single-method choices because the Biometric Framework runs in a higher-priority thread isolated from FRP checks. A simple PIN such as 1234 is set, the fingerprint step is skipped, and the device is restarted.
After reboot the new PIN satisfies the FRP check, allowing the Google account setup screen to display an active Skip button. The device can then be configured with a fresh account.
Technical root cause
The exploit succeeds because of three weaknesses in HTC Sense: context isolation that prevents direct calls to ChooseLockGeneric, higher architectural priority of Credential Storage requests over FRP flags, and separation of the biometric registration thread from setup-wizard restrictions. The technique is specific to older HTC firmware and demonstrates how legacy email and certificate subsystems can still be leveraged for lock bypass.
Related articles
Node.js Issues Security Updates Patching Ten Vulnerabilities Including High-Severity TLS Name Verification Bypasses
The Node.js project released security updates on October 21 for release lines 26, 24, and 22, addressing ten vulnerabilities with four rated high severity. The most critical issue, CVE-2026-111497, resides in the Brotli decoder and involves an out-of-bounds write that could enable remote code execution across all three supported lines. Two additional high-severity flaws affect TLS name verification: CVE-2026-105483 bypasses checks when addresses contain full-width digits, while CVE-2026-106069 fails on imprecise IP address resolution, potentially allowing a certificate to be accepted for an unintended destination. A fourth high-severity vulnerability, CVE-2026-105482, causes the dns.resolve function to truncate names containing null characters, creating inconsistencies between queried and resolved names. Medium-severity issues include out-of-order processing in HTTP socket keep-alive, improper certificate validation for non-standard IPv4 addresses, and repeated cryptographic random values in snapshot initialization and single-executable applications affecting crypto.randomUUID and crypto.randomInt. The updates also refresh c-ares, CA certificates, Undici, OpenSSL, and SQLite, with recommendations to test HTTPS outbound connections, DNS handling, Brotli-compressed content, and permission-restricted workloads.
Yandex Station Root Access Flaw Exploited via Trusted Certificates Error, Patch Now Rolling Out
Enthusiasts discovered a method to obtain root access on their own Yandex Station smart speaker by exploiting an error in the trusted certificates system, bypassing the need to physically disassemble the device. The technique involved instructing the Alice voice assistant to play music and then probing for administrator privileges on the hardware. Yandex confirmed the vulnerability and has begun distributing an over-the-air update to close the access vector. Root privileges enable users to modify device software with far fewer restrictions than standard settings allow, expanding options for custom experimentation. The company emphasized that the flaw only affected a user's own device and that remote compromise of third-party units remained nearly impossible before the fix. Yandex also noted that owners previously could achieve similar customization by opening the device and flashing custom firmware, but the new method avoids any hardware intrusion. Work continues on refining the factory reset process, though specific details remain undisclosed.
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.