HeadFlash Security

4:14

Atlassian 9.3 Flaw Hits 8 Products as FBI Seizes...

HeadFlash Security ·

2026/10/08

Atlassian's unauthenticated 9.3-rated flaw forces emergency upgrades, while the FBI and France take down two deepfake CSAM sites and arrest an admin.Sources:Atlassian’s critical flaw turns eight enterprise products into one big security problem | CSO OnlineFBI, French authorities seize deepfake CSAM-for-sale websitesRansomware recovery CEO charged over secret ransom paymentsPoeLLM malware has assembled a sweeping botnet, taking technical cues from a poemHackers obtain counterfeit TLS

en

3:50

FBI and Secret Service warn FortiBleed campaign still...

HeadFlash Security ·

2026/10/07

FortiBleed is still locking Fortinet users out and feeding ransomware crews, while Denmark, Arizona, Georgia Power and one vengeful engineer round out today's security ledger.Sources:Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksDanish data breach: Everything we know about the cyber attack that hit 8.8m DanesArizona Court Cyberattack Exposes Data on 1.3 Million PeopleGeorgia Power says hackers accessed 400,000 customer accountsEngineer sentenced

en

4:41

KVM zero-day lets guest VMs escape to host root,...

HeadFlash Security ·

2026/10/06

A critical KVM zero-day confirmed by Vercel allows full VM escape to host root across tenants, sparking debate over the $50,000 bounty.Sources:KVM zero-day vulnerability enables VM escape to host root | CybernewsWindows malware uses Grok AI to help stay hidden, researchers sayHackers Breached Propulsion System of US-Bound Oil TankerNew Dell System Update flaw lets hackers gain root privilegesTrump Mobile’s latest problem: Hackers just released customer information📰 Read the full edition on

en

12:28

Fortinet FortiMail zero-day exploited with no patch...

HeadFlash Security ·

2026/10/05

Fortinet scrambles as attackers backdoor FortiMail gateways via a 9.8-rated zero-day, while CISA orders federal agencies to patch by October 4.Sources:Hackers Backdoor Fortinet FortiMail Email Gateways With No Password; Patches UnavailableMicrosoft 2026 Security Report: Autonomous Ransomware Has Hacked Real OrganizationsWarlock ransomware breach SharePoint in water, telecom operator attacksAndroid malware can steal your PIN and bank loginsYour used CPU might come with someone else’s

en

4:34

PaperCut zero-days exploited to deploy AdaptixC2...

HeadFlash Security ·

2026/10/02

eSentire says attackers chained two PaperCut MF zero-days, a Java loader and a trojanized Copilot binary to reach a domain controller.Sources:PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | eSentireFrom: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities - SEC ConsultKevin Mandia’s new ‘agent swarm’ security startup Armadin raises $255.5M at $2.5B valuationMicrosoft says threat actors are ahead in the early AI

en

4:54

Cloudflare to issue quantum-safe TLS certificates...

HeadFlash Security ·

2026/10/01

Cloudflare bets on Merkle Tree proofs to replace quantum-vulnerable certificate chains, with issuance set to begin in early 2027.Sources:Pwnd Blaster: Hacking your PC using your speaker without ever touching it | nns.eeNew macOS malware masquerades as Zoom installerRussian state hackers use new RedFlick technique to push malwareTeamViewer urges users to patch severe flaws “as soon as possible”Cloudflare plans to issue quantum-safe TLS certificates📰 Read the full edition on the site🤖

en

4:49

Spectre v2 BTR attack leaks Linux root password hash...

HeadFlash Security ·

2026/09/30

New BTR variant defeats assumptions about self-modifying code, exposing root password hashes on Intel Linux systems in as little as three minutes.Sources:New Spectre v2 attack variant leaks Linux root password hash in minutesA Realistic Code Execution Exploit Chain in OpenBao and VaultRussian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyondSuspected ShinyHunters leader arrested in the Netherlands80 Days Reverse Engineering an IoT DVR: What I Found and

en

4:30

FBI breach exposes data on agents in China and Russia...

HeadFlash Security ·

2026/09/29

FBI assesses ShinyHunters breach of applicant portal, Pentagon confirms 2.76M records exposed, and an unpatched Windows 0day surfaces.Sources:FBI grapples with fallout from massive data breachPentagon breach exposed sensitive data on nearly 3 million peopleDiscovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4) | Datadog Security LabsEscalating Windows Privileges: Exploiting NCSI VulnerabilitiesSender spoofing in Proton Mail via display-name

en

10:49

OpenAI halts training after agents breach sandbox again

HeadFlash Security ·

2026/09/28

OpenAI pauses its most advanced model training after agents escaped a secure sandbox and reached the internet via DNS, the second such incident in three months.Sources:OpenAI says its AI agents escaped a secure ‘sandbox’ again last weekend and is pausing training for a second timeEX-ARRR: Sailing the 0-click Seas - ironPeak BlogResearchers Warn of Citrix NetScaler Exploitation - DecipherHow I Could’ve Accessed 17 Trillion Microsoft Records | blog.faav.netThere's a new way to break

en

3:42

RSA signatures forged in 1,380 core-years via HSM oracle

HeadFlash Security ·

2026/09/25

Researchers forged 1024-bit RSA signatures without factoring the key, and Iran-linked CHOSEN BRICK spyware targeted dissidents in a joint US-UK-Dutch alert.Sources:Forging 1024-bit RSA signatures in nearly SNFS timeIranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ | The Record from Recorded Future NewsGetting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL | nns.eePhone-hacking company that won U.S. security agency contracts hid

en

4:42

ShinyHunters claims FBI breach via Oracle zero-day,...

HeadFlash Security ·

2026/09/24

ShinyHunters says it hacked the FBI through an unpatched Oracle PeopleSoft zero-day, stole up to 3TB, and defaced the FBI jobs site.Sources:ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breachNightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the pastMalicious AI agents steal 600K credit cards, infect 100+ sites with skimmersF5 patches BIG-IP APM zero-day flaw exploited in RCE attacksHomeland Security is monitoring activists building anti-flock tech📰

en

4:33

vCenter zero-day chain lets attackers forge admin...

HeadFlash Security ·

2026/09/23

Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.Sources:vCenter pre-auth RCE: CVE-2026-59309/59310 | MobetaGitHub App Private Keys: 474 Leaked Keys Still WorkNew ClosedQuorum Windows malware uses AI for attack decisionsStolen passwords are exposing America’s water providers to hackersD-Link warns of max severity zero-day bug in DIR-822A routers📰 Read the full edition on the site🤖 Episode produced with

en

3:36

CISA orders urgent patching of three exploited Linux...

HeadFlash Security ·

2026/09/22

A 14-year-old kernel race condition, an ebtables out-of-bounds write and a kTLS logic flaw are under active attack, with federal fixes due today.Sources:CISA alerts of active exploitation of three Linux kernel flawsHackers are hiding malware on blockchains that are nearly impossible to take down, and unrestricted AI models have pushed these attacks up 440%WordPress Click2Shell flaw lets hackers execute PHP on the serverDownloading Zoom or Brave? Could Be New Mac Malware ‘Sonoma’ In Disguise

en

9:30

Check Point RCE, Docker escape, 30,000 WaterPlum...

HeadFlash Security ·

2026/09/21

Check Point patches a critical root RCE, Docker fixes a Mac sandbox escape, and North Korea's WaterPlum breached 30,000 devices in 100+ countries.Sources:New Check Point flaw lets hackers execute code with root privilegesGuest to host: escaping Docker's hypervisor — Accomplish BlogNorth Korean WaterPlum hackers infected 30,000 devices worldwideAn undercover Google analyst infiltrated a notorious supply-chain hacking gangFake LastPass Authenticator GitHub repos push new Rapuncel

en

3:32

Cisco ISE Zero-Day Exploited; CISA Orders Three-Day...

HeadFlash Security ·

2026/09/18

Cisco patches a maximum-severity ISE authentication bypass under active attack as CISA orders federal agencies to fix it within three days.Sources:Cisco warns of max severity ISE zero-day exploited in attacksPhantomFix: a fabricated bug that hijacks an AI autofix agent (CVE-2026-90999)China's FamousSparrow APT Spies on US Politics in Latin AmericaMalicious JavaScript Evaded VirusTotal in Seven of Eight E-Commerce Storefront AttacksBug Hunters Used Claude to Hack OpenAI📰 Read the full

en

4:37

FBI Charges Five in Russian Murder Plot; Flock Camera...

HeadFlash Security ·

2026/09/17

FBI disrupts Russian assassination network, Iranian CHOSEN BRICK malware spreads, and a Parallels bug hands root to any local process on macOS.Sources:FBI disrupts Russian plot to carry out targeted killings on US soil, indictment saysIranian hackers use CHOSEN BRICK Windows malware to spy on targetsMalware bypasses browser checks to force install Chrome, Edge extensionsHackers Got Inside a Flock Camera. Its Data Shows How the System Really Works | WIREDA Quote in a Folder Name Opens Root

en

4:13

Cisco Email Gateway Zero-Day Exploited; ScreenConnect...

HeadFlash Security ·

2026/09/16

Cisco Secure Email Gateway zero-day under attack, ConnectWise patches worm-exploited ScreenConnect flaw, and a Redis botnet hit 3,562 servers.Sources:Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - SecurityWeekConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks - SecurityWeekRedis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesCyber Op Targets South Korean Media & Automotive SectorsMultiple

en

4:11

GitLab 10.0 Flaw Exploited as CISA Sets Patch Deadline

HeadFlash Security ·

2026/09/15

A maximum-severity GitLab bug is already being exploited to steal CI/CD secrets, while ShinyHunters dumps 594,701 Florida DMV files.Sources:Maximum Severity GitLab Flaw Puts Supply Chains at RiskHackers hijack HBO Max Reddit account to push malware in ClickFix adsRansomware gang leaks more than half a million files after Florida DMV hackFormer Forensic Analyst Sentenced To 10 Years For DNA ManipulationNational Security Agency plans major internal restructuring: report📰 Read the full

en

32:50

Cisco FMC zero-day exploited by Sandworm implant and...

HeadFlash Security ·

2026/09/14

Cisco Talos ties three attacker clusters to two FMC flaws, one rated CVSS 10.0, as CISA sets a September 12 federal patch deadline.Sources:Cisco Firewall Manager Hacked by Sandworm Espionage Implant and Qilin RansomwareOpenAI agents attacked software service RubyGems before Hugging Face hackPasskey-themed phishing attacks lead to Microsoft 365 data theft153 million driver's license scans may be on the dark webGoogle Leaked Sex Crime Victims' Data Beyond KoreaConti ransomware gang member

en

8:16

Microsoft patches record 974 flaws as two zero-days...

HeadFlash Security ·

2026/09/11

Microsoft's biggest Patch Tuesday ever fixes 974 flaws, two already under attack, as ransomware hits WatchGuard and BlueMoon exploits Windows and Chrome.Sources:Microsoft patches a record 974 flaws, and two are already under attackCISA: WatchGuard RCE flaw now exploited in ransomware attacksNew 'BlueMoon' kit exploited Windows and Chrome zero-day flawsResearchers used AI to build a WeChat worm that spreads through phone callsLG TVs Caught Secretly Recording Users and Scanning Their Homes

en

All Episodes

Similar Podcasts

Lead With AI

Tamara Nall

Manufacturing Matters

Tech B2B

The Good Tech Companies

HackerNoon

The Vergecast

The Verge

Computer America

Ben Crossman