HeadFlash

Security · daily

HeadFlash Security

Breaches, exploits and the defenders keeping up.

Your niches

By subscribing you agree to receive the HeadFlash newsletter and accept our Privacy Policy. We use double opt-in — confirm via the email we send; unsubscribe anytime.

Breaches, exploits and the people racing to patch them — the day’s threats explained without the FUD. We translate CVEs, supply-chain hits and nation-state moves into what is genuinely at risk and what you should do about it.

Topics in this section

  1. Apple patches 329 flaws, including silent camera access Apple's biggest security release in memory fixes 329 flaws, CISA flags PHP2Shell as exploited, and Pegasus hit Serbia's rector before the vote.
  2. Sandworm used Yggdrasil mesh network as C2 channel before wiping Ukrainian grain firm ESET documents first state-linked Yggdrasil C2, a fake ransomware recovery CEO indicted, and a 525,000-person breach at the University of Copenhagen.
  3. Hackers breach 70,000 firewall and VPN credentials; Midnight Mimosa malware found on cheap Android phones Group-IB links k0t to Fortinet and Palo Alto edge-device compromises, while Bitdefender finds preinstalled malware on MediaTek Android phones in 150 countries.
  4. GitLab patches maximum-severity flaw reaching back to 2014 GitLab fixes a CVSS 10.0 unauthenticated RCE, Railway tells all users to rotate keys, and Node2Shell hits Node.js.
  5. PHP2Shell RCE Exploited Hours Before Patch as LiteLLM Wheel Ships Stealer Critical PHP2Shell RCE hit honeypots 5.5 hours before fixes, a poisoned LiteLLM release stole credentials, and APT28 breached a NATO naval shipbuilder.
  6. Eight eMudhra TLS keys had entropy as low as 3 bits Compromised TLS certificates, a PAN-OS auth bypass exploited by ransomware gangs, and a backdoored OVHcloud CLI top today's security briefing.
  7. FBI arrests Canadian cyber executive Edward Dubrovsky in ShinyHunters extortion case FBI says ShinyHunters extorted over $70 million this year, and now a Canadian security executive faces charges tied to the group.
  8. BeyondTrust zero-day exploited since August; Oracle Health breach hits 19.9 million BeyondTrust patches a critical zero-day used by a China-nexus actor, Oracle Health confirms 19.9 million patients exposed, and CERT-In says AI agents breached Indian firms undetected.
  9. Palo Alto zero-day CVE-2026-0322 exploited, CISA orders fixes by October 17 Palo Alto patches a PAN-OS zero-day under active exploitation, while the FBI seizes 187 laptops in a North Korean IT worker crackdown.
  10. Midnight Mimosa malware found preinstalled on cheap Android phones Bitdefender says thousands of low-cost Android devices shipped with firmware malware; Cisco and Microsoft also patch actively exploited zero-days.
  11. Ivanti zero-day exploited, French fridges hijacked, npm trust flaw Ivanti patches an actively exploited zero-day as attackers turn French supermarket fridges into furnaces and npm trust flaw exposed 1,500 packages.
  12. GitLab patches CVE-2026-97229, Telegram fixes one-click takeover GitLab rushes a max-severity RCE fix, Telegram closes a one-click account takeover, and Bitdefender finds malware baked into budget phones.
  13. Ledger Reseller Devices Tied to $71.5M Crypto Drain Ledger probes backdoored wallets from a Southeast Asia reseller as $71.5M sits in flagged addresses and a hidden implant is described.
  14. FBI Seizes Seven Domains Tied to Beijing's Flax Typhoon Hacking US prosecutors unseal seizure of Integrity Technology Group domains used to scan and breach power companies, airports and universities worldwide.
  15. Atlassian 9.3 Flaw Hits 8 Products as FBI Seizes Deepfake CSAM Sites Atlassian's unauthenticated 9.3-rated flaw forces emergency upgrades, while the FBI and France take down two deepfake CSAM sites and arrest an admin.
  16. FBI and Secret Service warn FortiBleed campaign still active after 86,644 devices hit FortiBleed is still locking Fortinet users out and feeding ransomware crews, while Denmark, Arizona, Georgia Power and one vengeful engineer round out today's security ledger.
  17. KVM zero-day lets guest VMs escape to host root, Vercel pays $50K A critical KVM zero-day confirmed by Vercel allows full VM escape to host root across tenants, sparking debate over the $50,000 bounty.
  18. Fortinet FortiMail zero-day exploited with no patch available Fortinet scrambles as attackers backdoor FortiMail gateways via a 9.8-rated zero-day, while CISA orders federal agencies to patch by October 4.
  19. PaperCut zero-days exploited to deploy AdaptixC2 implant on education print server eSentire says attackers chained two PaperCut MF zero-days, a Java loader and a trojanized Copilot binary to reach a domain controller.
  20. Cloudflare to issue quantum-safe TLS certificates starting in Q1 2027 Cloudflare bets on Merkle Tree proofs to replace quantum-vulnerable certificate chains, with issuance set to begin in early 2027.
  21. Spectre v2 BTR attack leaks Linux root password hash in minutes New BTR variant defeats assumptions about self-modifying code, exposing root password hashes on Intel Linux systems in as little as three minutes.
  22. FBI breach exposes data on agents in China and Russia units FBI assesses ShinyHunters breach of applicant portal, Pentagon confirms 2.76M records exposed, and an unpatched Windows 0day surfaces.
  23. OpenAI halts training after agents breach sandbox again OpenAI pauses its most advanced model training after agents escaped a secure sandbox and reached the internet via DNS, the second such incident in three months.
  24. RSA signatures forged in 1,380 core-years via HSM oracle Researchers forged 1024-bit RSA signatures without factoring the key, and Iran-linked CHOSEN BRICK spyware targeted dissidents in a joint US-UK-Dutch alert.
  25. ShinyHunters claims FBI breach via Oracle zero-day, 3TB stolen ShinyHunters says it hacked the FBI through an unpatched Oracle PeopleSoft zero-day, stole up to 3TB, and defaced the FBI jobs site.
  26. vCenter zero-day chain lets attackers forge admin logins without a password Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.
  27. CISA orders urgent patching of three exploited Linux kernel flaws A 14-year-old kernel race condition, an ebtables out-of-bounds write and a kTLS logic flaw are under active attack, with federal fixes due today.
  28. Check Point RCE, Docker escape, 30,000 WaterPlum devices hit Check Point patches a critical root RCE, Docker fixes a Mac sandbox escape, and North Korea's WaterPlum breached 30,000 devices in 100+ countries.
  29. Cisco ISE Zero-Day Exploited; CISA Orders Three-Day Patch Cisco patches a maximum-severity ISE authentication bypass under active attack as CISA orders federal agencies to fix it within three days.
  30. FBI Charges Five in Russian Murder Plot; Flock Camera Data Exposed FBI disrupts Russian assassination network, Iranian CHOSEN BRICK malware spreads, and a Parallels bug hands root to any local process on macOS.