HeadFlash

Daily tech-news flash

AI, privacy and security, caught up in five minutes.

A short email and matching podcast for each niche you pick, every weekday — what moved, why it matters, and where to read the full story. No noise, no hype.

Your niches

By subscribing you agree to receive the HeadFlash newsletter and accept our Privacy Policy. We use double opt-in — confirm via the email we send; unsubscribe anytime.

01

AI

  1. OpenAI's Linux kernel sweep finds 948 privilege-escalation bugs OpenAI's autonomous scanner found 948 Linux kernel privilege-escalation flaws for $1.2M in API credits, as banks block AI agents from accounts and Cursor ships app deployment.
  2. OpenAI's GPT-6 Cyber finds 81 Firefox flaws and breaks into Linux GPT-6 Cyber hunts exploits and patches, Firefox fixes 81 new flaws, and no AI agent clears 12 percent on SemiAnalysis' new real-work benchmark.
  3. Anthropic's FlashProve verifies AI outputs without revealing model weights Anthropic open-sources a cryptographic prototype that proves which model produced a response, plus GPT-6 Astra edits other models' weights directly.
  4. OpenAI's GPT-6 Astra designed a working hardware device in under a week OpenAI says GPT-6 Astra handled enclosure, PCB layout, firmware and UI for a Codex device in under a week, while Anthropic filed for a record IPO.
  5. Anthropic says it may be near recursive self-improvement threshold Anthropic flags RSI risk in filing, Chinese hackers use ARTEX AI against 200 orgs, Goldman limits AI coding tools to engineers, and ChatGPT adds PIN-locked chats.
More AI
02

Privacy

  1. Meta Pixel health-tracking class action certified; Google cuts off Videostrong over XCPE backdoor Meta must face four certified classes over medical data captured by its Pixel, while Google bans a TV-box maker for a backdoor in 1.3 million devices.
  2. UK ICO Asks AI Agent Builders 30 Data Protection Questions by November 20 ICO opens a call for evidence on how AI agents handle personal data, with responses due November 20 and guidance plus a statutory code to follow.
  3. Ring AI apps let landlords count tenants; WA facial recognition trial ends with 122 arrests Ring's third-party AI apps turn cameras on tenants, a WA facial recognition trial scanned 1.38 million faces, and mSecure warns customers after a breach.
  4. Lenovo's 'encrypted' fingerprint USB drive was just a plain SD card A researcher found Lenovo's AES-256 fingerprint stick stored data unencrypted, and follow-up work surfaced backdoors and hardcoded keys in other 'secure' drives.
  5. Vizio smart TVs keep sending viewing data even after users opt out, study finds A Northeastern study of 5,943 experiments finds ACR opt-outs fail on most smart TV platforms, with Vizio traffic persisting in every opted-out test.
More Privacy
03

Security

  1. SonicWall SSL-VPN zero-day exploited as CISA orders fixes SonicWall patches an exploited SSL-VPN auth bypass, CISA flags a WordPress core flaw, and a fake GitHub tool campaign has infected 2,000 Windows systems.
  2. BlackX bootkit breaches fully patched Windows via Secure Boot gap Kaspersky finds BlackX UEFI bootkit infecting fully patched Windows systems, exploiting an unrevoked Microsoft certificate. Plus: a €118M bank heist and more.
  3. Quantum study: 22,593 cat qubits could break RSA-2048 in 3.14 days Alice & Bob preprint estimates a cat-qubit system could factor RSA-2048 in days, plus Vercel's DBSC rollout and a GNU Savannah backdoor report.
  4. Anthropic AI finds Linux kernel 9.8 flaw; 319 Chrome extensions hijacked searches An AI model built a working remote root exploit for a critical Linux TCP bug, while 319 Chrome extensions with 13.4 million installs were caught hijacking searches.
  5. Google bans Videostrong after 1.3M Android TV boxes found backdoored Google dismantles the XCPE botnet, Ivanti patches two more zero-days, and a new infostealer uses LLMs to profile victims.
More Security