HeadFlash Security

Google patches its eighth exploited Chrome zero-day this year, the wfx-loot campaign loots cloud secrets, and Synology fixes a 9.8-rated DSM bug.

Sources:

• Google patches eighth Chrome zero-day exploited in attacks this year
• Hackers compromise 4,800 GitHub accounts to steal cloud credentials
• Synology patches a critical NAS flaw that could let attackers in without logging in
• Electron, we have a problem
• A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure | WIRED

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

N-able shuts hosted N-central and tells on-prem users to go dark after a researcher drops 33 zero-days with PoC exploits; honeypots already see probing.

Sources:

• N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
• Chainalysis says hackers stole credentials and tokens for all of its customers - Ars Technica
• Active ScreenConnect attacks breach MSPs, impact dozens of organizations
• eBPF Rootkits: Why Underground Actors Are Taking Notice
• A High-Severity Bug Could Have Stalled Bitcoin Mining—Bitcoin Core Has a Fix

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Record Patch Tuesday with an exploited Outlook zero-day, plus Russian hackers using hijacked Exchange servers as their own command infrastructure.

Sources:

• Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
• Turla hackers use new Cereal malware to spy on govt Exchange servers
• Researchers Hacked Cars Because the Automaker Used 'Admin:Admin' as a Password
• iOS Sandbox Escape Puts Crypto Wallet Data at Risk

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

SSHole attacks hit Linux systems, QNAP warns on Plex2Shell, and OpenAI's GPT-6 Cyber surfaces thousands of kernel vulnerabilities.

Sources:

• Hackers exploit SSHole OpenSSH flaw to breach Linux systems
• QNAP says more NAS devices hit in worrying Plex2Shell malware attacks
• OpenAI says its new cyber-focused AI model found thousands of Linux kernel vulnerabilities
• Hackers use n-day exploits in zero-click attacks on iOS, Android devices
• PHP2Shell

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

SonicWall patches an exploited SSL-VPN auth bypass, CISA flags a WordPress core flaw, and a fake GitHub tool campaign has infected 2,000 Windows systems.

Sources:

• SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
• Snort, the Network Guardian, Falls to a ZIP Archive | DeafNews
• Fake security tools on GitHub push backdoors and infostealers
• Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
• ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security
• macOS 27.3 Is Fixing a Mac Security Problem That Could Have Let Hackers Pretend to Be Websites You Trust With Your Personal Information
• How North Korea turns child prodigies into crypto thieves
• GhostMap Android flaw lets malicious app trigger persistent boot loop
• Firecracker VM Escape: PwnEscape Part 2. | PWN.AI Security Research
• CPython 0-Day Vulnerabilities Threaten the AI Supply Chain | RunSybil Blog
• acidvegas x blog - the port that does not exist

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Kaspersky finds BlackX UEFI bootkit infecting fully patched Windows systems, exploiting an unrevoked Microsoft certificate. Plus: a €118M bank heist and more.

Sources:

• UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame? - Ars Technica
• Hackers backdoor Linux servers using trojanized CWP web server
• Israeli Spy Company Busted Using Malware Ads To Infect, Locate, And Spy On Starlink Users
• Hackers Steal Estimated 118 Million Euros in Cyberattack on French Bank
• Filen's password onion made me cry

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Alice & Bob preprint estimates a cat-qubit system could factor RSA-2048 in days, plus Vercel's DBSC rollout and a GNU Savannah backdoor report.

Sources:

• A Quantum Computer Could Crack Major Internet Encryption in Just 3 Days, Study Suggests
• Securing Internet-Critical Software: How We Could Have Backdoored Bash | Hacktron AI
• Vercel rolls out new protection against stolen session cookie attacks
• Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
• Jailbreaking my car's navigation system just so I can change the time | nns.ee

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

An AI model built a working remote root exploit for a critical Linux TCP bug, while 319 Chrome extensions with 13.4 million installs were caught hijacking searches.

Sources:

• Critical Linux kernel flaw allows remote root attacks on MPTCP servers
• Chrome extensions with 13.4 million installs caught hijacking searches
• SMS of Death: An 8-Byte Message Crashes Android and Blocks Emergency Calls | DeafNews
• Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
• Reverse Engineering a Children’s Camera (and Making It Run Doom) | Spode’s Abode

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Google dismantles the XCPE botnet, Ivanti patches two more zero-days, and a new infostealer uses LLMs to profile victims.

Sources:

• Google disrupts million-device XCPE Android malware botnet, bans TV box maker
• Ivanti patches two more Connect Secure zero-days chained in attacks
• Supermarket hacks across Europe: why are fridges connected to the internet?
• Infostealer uses LLMs to compile dossiers on victims
• Apple recently notified users in 99 countries of potential mercenary spyware attacks

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

The largest crypto theft on record, a trojanized Claude Code extension, and an AI model that chained zero-days into working exploits.

Sources:

• North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
• Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
• Researchers uncover Volt Typhoon’s covert, ephemeral network | CyberScoop
• Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets | MongoDB
• The case of the 9 bit AES key | V12
• CVE-2026-98432: The CVSS War Over the Linux Kernel TCP Vulnerability | DeafNews
• TightVNC Viewer Pre-auth RCE - SSD Secure Disclosure
• NIK C2: The new AI-enabled command-and-control framework
• New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
• A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards | WIRED

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.