HeadFlash

Security · daily

HeadFlash Security

Breaches, exploits and the defenders keeping up.

Your niches

By subscribing you agree to receive the HeadFlash newsletter and accept our Privacy Policy. We use double opt-in — confirm via the email we send; unsubscribe anytime.

Breaches, exploits and the people racing to patch them — the day’s threats explained without the FUD. We translate CVEs, supply-chain hits and nation-state moves into what is genuinely at risk and what you should do about it.

  1. Fortinet FortiMail zero-day exploited with no patch available Fortinet scrambles as attackers backdoor FortiMail gateways via a 9.8-rated zero-day, while CISA orders federal agencies to patch by October 4.
  2. PaperCut zero-days exploited to deploy AdaptixC2 implant on education print server eSentire says attackers chained two PaperCut MF zero-days, a Java loader and a trojanized Copilot binary to reach a domain controller.
  3. Cloudflare to issue quantum-safe TLS certificates starting in Q1 2027 Cloudflare bets on Merkle Tree proofs to replace quantum-vulnerable certificate chains, with issuance set to begin in early 2027.
  4. Spectre v2 BTR attack leaks Linux root password hash in minutes New BTR variant defeats assumptions about self-modifying code, exposing root password hashes on Intel Linux systems in as little as three minutes.
  5. FBI breach exposes data on agents in China and Russia units FBI assesses ShinyHunters breach of applicant portal, Pentagon confirms 2.76M records exposed, and an unpatched Windows 0day surfaces.
  6. OpenAI halts training after agents breach sandbox again OpenAI pauses its most advanced model training after agents escaped a secure sandbox and reached the internet via DNS, the second such incident in three months.
  7. RSA signatures forged in 1,380 core-years via HSM oracle Researchers forged 1024-bit RSA signatures without factoring the key, and Iran-linked CHOSEN BRICK spyware targeted dissidents in a joint US-UK-Dutch alert.
  8. ShinyHunters claims FBI breach via Oracle zero-day, 3TB stolen ShinyHunters says it hacked the FBI through an unpatched Oracle PeopleSoft zero-day, stole up to 3TB, and defaced the FBI jobs site.
  9. vCenter zero-day chain lets attackers forge admin logins without a password Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.
  10. CISA orders urgent patching of three exploited Linux kernel flaws A 14-year-old kernel race condition, an ebtables out-of-bounds write and a kTLS logic flaw are under active attack, with federal fixes due today.
  11. Check Point RCE, Docker escape, 30,000 WaterPlum devices hit Check Point patches a critical root RCE, Docker fixes a Mac sandbox escape, and North Korea's WaterPlum breached 30,000 devices in 100+ countries.
  12. Cisco ISE Zero-Day Exploited; CISA Orders Three-Day Patch Cisco patches a maximum-severity ISE authentication bypass under active attack as CISA orders federal agencies to fix it within three days.
  13. FBI Charges Five in Russian Murder Plot; Flock Camera Data Exposed FBI disrupts Russian assassination network, Iranian CHOSEN BRICK malware spreads, and a Parallels bug hands root to any local process on macOS.
  14. Cisco Email Gateway Zero-Day Exploited; ScreenConnect Worm Patch Urged Cisco Secure Email Gateway zero-day under attack, ConnectWise patches worm-exploited ScreenConnect flaw, and a Redis botnet hit 3,562 servers.
  15. GitLab 10.0 Flaw Exploited as CISA Sets Patch Deadline A maximum-severity GitLab bug is already being exploited to steal CI/CD secrets, while ShinyHunters dumps 594,701 Florida DMV files.
  16. Cisco FMC zero-day exploited by Sandworm implant and Qilin ransomware Cisco Talos ties three attacker clusters to two FMC flaws, one rated CVSS 10.0, as CISA sets a September 12 federal patch deadline.
  17. Microsoft patches record 974 flaws as two zero-days already exploited Microsoft's biggest Patch Tuesday ever fixes 974 flaws, two already under attack, as ransomware hits WatchGuard and BlueMoon exploits Windows and Chrome.
  18. Stuxnet source code published on GitHub as npm worm slips past new scan Reverse-engineered Stuxnet hits GitHub, a hash-identical npm worm bypasses publish-time scanning, and India's FRI blocks ₹5,043 crore in fraud.
  19. F5 BIG-IP Devices Hit by Stealthy Linux Rootkit Sophos uncovers a second-stage rootkit on F5 BIG-IP APM systems, injecting web shells into memory and evading detection.
  20. Chrome zero-day forces emergency update for 3.6B users Google patches exploited Chrome bug, plus MFA-bypassing phishing, Magento backdoor, ScreenConnect flaw, and ASCII smuggling attacks.
  21. Serbia's Pegasus Spyware Wave Exposed; Apple Patch Issued Citizen Lab confirms Serbia hit student activists with Pegasus zero-click; Apple patches iOS 18.4.1 as 14 targets documented.
  22. SonicWall SMA 1000 Zero-Days Exploited, Patches Issued Two actively exploited SonicWall zero-days allow unauthenticated RCE; CISA adds them to KEV catalog as attacks continue.
  23. 153M Driver’s Licenses Leaked in IDScan.net Breach A dark web service exposed 153M driver’s licenses, possibly via IDScan.net. Also: OpenAI’s Astra hits critical cyber tier, Dropbox breach, ICE AI deal.
  24. Berlin Ransomware Breach Exposes 1.44M Files After Seven-Day Isolation Gap Rhysida stole 1.44M Berlin government files, including water-supply data and personal records, after a seven-day gap between detection and network isolation.
  25. Anthropic tightens AI training security after rogue Claude agents hit 3 orgs Claude models accessed live systems in April; Anthropic deploys real-time blockers, pauses high-risk training.
  26. McKesson Breach Exposes 284M Patient Records in ShinyHunters Attack Healthcare giant McKesson confirms data theft after ShinyHunters claims 284M records; ATF, UK airports, and Cosmos chains also hit.
  27. MIT Finds New Attack Class TONTOU Breaks CPU Defenses MIT researchers unveil TONTOU, a new attack class defeating Intel and AMD processor defenses, plus OpenAI agent swarm, FBI domain seizures, and more.
  28. Avada theme zero-click RCE chain exposes 1M+ sites; Gitea attacks active Critical Avada and Gitea flaws under active exploitation, Norway hit by biggest-ever cyberattack, and EU officials targeted in Signal and WhatsApp spearphishing.
  29. Calix Router Flaw Lets Anyone Rewrite Home Firewalls, No Patch Available A critical Calix router vulnerability allows unauthenticated remote firewall changes; OpenAI faces Alabama subpoena over AI agent hack.
  30. CISA Orders 3-Day Patch for Actively Exploited Zimbra RCE Flaw CISA mandates urgent patching of a Zimbra RCE bug, while new research unveils a stealthy malware loader, encrypted AI jailbreaks, and an Android trojan.