HeadFlash Security — a ~4-minute daily brief on cybersecurity: breaches, vulnerabilities and defense. New episode every weekday morning.
Latest episodes
-
4 min
Sandworm used Yggdrasil mesh network as C2 channel before wiping Ukrainian grain firm
ESET documents first state-linked Yggdrasil C2, a fake ransomware recovery CEO indicted, and a 525,000-person breach at the University of Copenhagen.Sources:Sandworm Turns Yggdrasi…
-
10 min
Hackers breach 70,000 firewall and VPN credentials; Midnight Mimosa malware found on cheap Android phones
Group-IB links k0t to Fortinet and Palo Alto edge-device compromises, while Bitdefender finds preinstalled malware on MediaTek Android phones in 150 countries.Sources:Hackers Breac…
-
4 min
GitLab patches maximum-severity flaw reaching back to 2014
GitLab fixes a CVSS 10.0 unauthenticated RCE, Railway tells all users to rotate keys, and Node2Shell hits Node.js.Sources:Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticat…
-
4 min
PHP2Shell RCE Exploited Hours Before Patch as LiteLLM Wheel Ships Stealer
Critical PHP2Shell RCE hit honeypots 5.5 hours before fixes, a poisoned LiteLLM release stole credentials, and APT28 breached a NATO naval shipbuilder.Sources:PHP2Shell: critical P…
-
5 min
Eight eMudhra TLS keys had entropy as low as 3 bits
Compromised TLS certificates, a PAN-OS auth bypass exploited by ransomware gangs, and a backdoored OVHcloud CLI top today's security briefing.Sources:The Internet goes on high aler…
-
5 min
FBI arrests Canadian cyber executive Edward Dubrovsky in ShinyHunters extortion case
FBI says ShinyHunters extorted over $70 million this year, and now a Canadian security executive faces charges tied to the group.Sources:Feds Suspect Ransom Negotiator Ran ShinyHun…
-
13 min
BeyondTrust zero-day exploited since August; Oracle Health breach hits 19.9 million
BeyondTrust patches a critical zero-day used by a China-nexus actor, Oracle Health confirms 19.9 million patients exposed, and CERT-In says AI agents breached Indian firms undetect…
-
5 min
Palo Alto zero-day CVE-2026-0322 exploited, CISA orders fixes by October 17
Palo Alto patches a PAN-OS zero-day under active exploitation, while the FBI seizes 187 laptops in a North Korean IT worker crackdown.Sources:Palo Alto Networks warns of PAN-OS RCE…
-
5 min
Midnight Mimosa malware found preinstalled on cheap Android phones
Bitdefender says thousands of low-cost Android devices shipped with firmware malware; Cisco and Microsoft also patch actively exploited zero-days.Sources:Low-cost Android phones sh…
-
5 min
Ivanti zero-day exploited, French fridges hijacked, npm trust flaw
Ivanti patches an actively exploited zero-day as attackers turn French supermarket fridges into furnaces and npm trust flaw exposed 1,500 packages.Sources:Ivanti warns of Connect S…
-
4 min
GitLab patches CVE-2026-97229, Telegram fixes one-click takeover
GitLab rushes a max-severity RCE fix, Telegram closes a one-click account takeover, and Bitdefender finds malware baked into budget phones.Sources:GitLab warns of max severity code…
-
10 min
Ledger Reseller Devices Tied to $71.5M Crypto Drain
Ledger probes backdoored wallets from a Southeast Asia reseller as $71.5M sits in flagged addresses and a hidden implant is described.Sources:Ledger's Crypto Wallets Reportedly Bac…
-
4 min
FBI Seizes Seven Domains Tied to Beijing's Flax Typhoon Hacking
US prosecutors unseal seizure of Integrity Technology Group domains used to scan and breach power companies, airports and universities worldwide.Sources:FBI Seizes Domains Used in…
-
4 min
Atlassian 9.3 Flaw Hits 8 Products as FBI Seizes Deepfake CSAM Sites
Atlassian's unauthenticated 9.3-rated flaw forces emergency upgrades, while the FBI and France take down two deepfake CSAM sites and arrest an admin.Sources:Atlassian’s critical fl…
-
4 min
FBI and Secret Service warn FortiBleed campaign still active after 86,644 devices hit
FortiBleed is still locking Fortinet users out and feeding ransomware crews, while Denmark, Arizona, Georgia Power and one vengeful engineer round out today's security ledger.Sourc…
-
5 min
KVM zero-day lets guest VMs escape to host root, Vercel pays $50K
A critical KVM zero-day confirmed by Vercel allows full VM escape to host root across tenants, sparking debate over the $50,000 bounty.Sources:KVM zero-day vulnerability enables VM…
-
12 min
Fortinet FortiMail zero-day exploited with no patch available
Fortinet scrambles as attackers backdoor FortiMail gateways via a 9.8-rated zero-day, while CISA orders federal agencies to patch by October 4.Sources:Hackers Backdoor Fortinet For…
-
5 min
PaperCut zero-days exploited to deploy AdaptixC2 implant on education print server
eSentire says attackers chained two PaperCut MF zero-days, a Java loader and a trojanized Copilot binary to reach a domain controller.Sources:PaperCut MF Zero-Day Intrusion: Java L…
-
5 min
Cloudflare to issue quantum-safe TLS certificates starting in Q1 2027
Cloudflare bets on Merkle Tree proofs to replace quantum-vulnerable certificate chains, with issuance set to begin in early 2027.Sources:Pwnd Blaster: Hacking your PC using your sp…
-
5 min
Spectre v2 BTR attack leaks Linux root password hash in minutes
New BTR variant defeats assumptions about self-modifying code, exposing root password hashes on Intel Linux systems in as little as three minutes.Sources:New Spectre v2 attack vari…