HeadFlash Security

Meta absorbs Virtue AI's red team; first fully autonomous ransomware spotted; NSA reboots TAO; Cloudflare fixes IPsec downgrade; China warns on Claude Code.

Sources:

• Meta Absorbs AI Security's Top Red Team as Autonomous Ransomware Arrives
• Microsoft patches RoguePlanet Defender zero-day vulnerability
• NSA revives 'Tailored Access Operations' name for elite hacking unit | The Record from Recorded Future News
• IPsec Downgrade Attack Survives ML-KEM: Cloudflare Ships Authentication Fix
• China Warns of Claude Code 'Backdoor' Security Risk

📰 Read the full edition on the site

One-in-two phones in Africa send telemetry to China; Linux kernel flaws enable guest escape and 5-second root; Ubiquiti critical patch; 7M driver licenses exposed.

Sources:

• 1-in-2 phones sold in Africa exfiltrate telemetry to China - NowSecure
• Google pays $250K for Linux vulnerability allowing guest VM escapes - Ars Technica
• Ubiquiti Patches CVE-2026-50746, Maximum-Severity Flaw in UniFi… | DeafNews
• Public Exploit Turns 15-Year Linux Kernel Flaw Into 5-Second Root Attack
• This Massive Data Breach Compromised Nearly 7 Million Driver's Licenses

📰 Read the full edition on the site

DeepSeek accidentally creates ransomware, a 16-year-old Linux flaw enables VM escape, and quantum circuits break ECC faster than Google.

Sources:

• DeepSeek accidentally built a working ransomware strain, experts note, 'What we are witnessing is a fundamental shift in how novel cyber attacks are born'
• New Januscape Linux flaw allows VM escape on Intel, AMD devices
• GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security
• Independent Labs Crack Google's Secret Cryptography Work
• Windows 11 identifier code used to track Scattered Spider perp after Microsoft shared info with FBI — 19-year-old US-Estonian hacker arrested over alleged ties to infamous extortion group | Tom's Hardware

📰 Read the full edition on the site

Microsoft pushes quantum readiness to 2029, Teams phishing drops EtherRAT, and a hacker arrest reveals Windows' persistent device ID.

Sources:

• 2-Click Remote Code Execution in Meccha Chameleon
• Fake IT support calls on Microsoft Teams push EtherRAT malware
• A Hacker's Arrest Reveals Microsoft Can Track Users Via a Windows Device ID
• Microsoft says 'cryptographically relevant quantum computers could arrive sooner than previously expected' as it bumps its QSP timeline to 2029
• Cloudflare replaces its blanket AI bot block with granular controls for search, training, and agent crawlers

📰 Read the full edition on the site

FBI and Google dismantle NetNut botnet; AI agent runs first fully autonomous ransomware; Apple accelerates patches after AI finds WebKit flaws.

Sources:

• Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus - The Citizen Lab
• FBI and Google Disrupt NetNut Botnet That Rented 2 Million Home Devices to Spies
• North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets
• Cyber experts issue alert after two ransomware groups team up on 'unprecedented' threat campaign
• Researchers say an AI agent just ran a ransomware attack from start to finish, with no human at the keyboard
• How LLM-driven EDR evasion works | SpecterOps
• Amazon Q Vulnerability: Compromise via MCP Auto-Execution | Wiz Blog
• Seiko SkyBridge Enterprise IoT Routers Hit With Permanent OS Injection: No Fix
• Apple Compresses Patch Cycle After AI Uncovers Four WebKit Flaws | DeafNews
• 'Agentic coding tools have access to everything they need for this': Security experts warn Claude Code can be exploited simply by trying to be helpful
• Fake Mac Clipboard App Delivers New Password-Stealing Malware
• India Court Order Puts Your Domain Registration Data at Risk Worldwide

📰 Read the full edition on the site

CISA warns of SharePoint attacks; Canada strikes fentanyl brokers; FIFA platform exposed; NetNut botnet disrupted; Opera blocks clipboard hijacking.

Sources:

• CISA: Microsoft SharePoint RCE flaw now actively exploited
• Canada’s electronic spy agency conducted cyberattacks on criminals brokering fentanyl ingredients, report says - The Globe and Mail
• I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. | bobdahacker
• Google: This Proxy Service Is Using TV Streaming Devices to Host Cybercrime
• Opera now blocks one of the sneakiest malware tricks around

📰 Read the full edition on the site

CitrixBleed memory overread, Gamaredon's first wiper, Mustang Panda's cloud spies, SimpleHelp bypass exploited, and BlueHammer now in ransomware campaigns.

Sources:

• CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
• Russian Hackers Gamaredon Weaponize WinRAR Flaw for First Destructive Strike
• China-Linked Mustang Panda Hides Spy Tools Inside India's Trusted Cloud Storage App
• SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux
• CISA: Windows BlueHammer flaw now exploited by ransomware gangs

📰 Read the full edition on the site

Microsoft purges 119 malware-laced Edge extensions; NAIC breach exposes credit data; Apple fast-patches for AI risks; Warner bill targets AI agents; SCOTUS curbs geofencing.

Sources:

• Microsoft Removes 119 Edge Extensions Hiding… | DeafNews
• US Federal Insurance Regulator Confirms Data Breach Via Oracle Flaw - Infosecurity Magazine
• Apple accelerates security updates in response to AI-powered hacking risks
• Warner bill would create federally vetted list for secure, trustworthy AI agents
• Supreme Court Supports Privacy Protections for Cellphone Location Data

📰 Read the full edition on the site

JLR attack blamed on Russian hackers, DirtyClone root exploit goes public, and more in today's security briefing.

Sources:

• Russian hackers were behind the Jaguar Land Rover attack that cost the British economy two and a half billion dollars
• Iranian national U.S. sought for $3.4 billion in hacking attacks arrested in Montenegro
• Linux Kernel Root Exploit Published: DirtyClone Attack Leaves No Trace
• GTA VI fans beware — experts warn 'a new wave of scam websites' is offering early access, but just stealing your bank details instead
• When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms
• Clone This Repo and I Own Your Machine | 0din.ai
• Polymarket Loses $3.1M to Frontend Vendor Hack While CFTC Investigation Deepens

📰 Read the full edition on the site

JetBrains plugins stole 70K API keys; Europol freezes $47M; macOS flaw disables security tools; AI worm spreads autonomously.

Sources:

• 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers | Halting Problems
• '27 million stolen login credentials have been recovered': Global coordinated takedown hits SocGholish, Amadey, and StealC malware networks where it hurt
• macOS security flaw lets hackers disable Mac protection tools without a password
• Fake USB Sticks Spread China-Linked Virus in Japan's Army
• 'You can't patch your way out of it': Cheap AI worm can spread between devices without human guidance — but how did scientists create it?

📰 Read the full edition on the site