HeadFlash Security

A 16-year-old buffer overflow in TianoCore EDK II PXE code scores 9.5 and touches most server vendors, plus Cisco SD-WAN malware and GRU sabotage.

Sources:

• Code-execution flaw in UEFI firmware affects most servers on planet Earth - Ars Technica
• Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
• GRU-Backed Hackers Burst Water Mains and Sparked Factory Fires From Denmark to California
• Microsoft Authenticator for Android: The 'Confused Deputy' That Handed Corporate Tokens to Any App | DeafNews
• Keystone to Destroy 18,835 Hardware Wallets After Authentication Key Theft

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Hacker leaks data on 41,000 DHS employees through Okta, while CISA confirms active exploitation of a critical Brotli flaw and sets a November 10 patch deadline.

Sources:

• A hacker stole more than 40,000 DHS employee records
• Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat
• Hackers hired a man to walk into a US law firm, CrowdStrike says
• CISA warns of hackers now exploiting critical Node2Shell flaw

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Apple's biggest security release in memory fixes 329 flaws, CISA flags PHP2Shell as exploited, and Pegasus hit Serbia's rector before the vote.

Sources:

• Apple Just Patched 329 Security Flaws Across iPhone, Mac, and iPad, Including One That Let Apps Secretly Access Your Camera
• CISA confirms PHP2Shell vulnerabilities now exploited in attacks
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation
• 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
• Three Labs Confirm Serbia Hacked Rector and Prosecutor With Pegasus Before Vote

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

ESET documents first state-linked Yggdrasil C2, a fake ransomware recovery CEO indicted, and a 525,000-person breach at the University of Copenhagen.

Sources:

• Sandworm Turns Yggdrasil Mesh Network Into C2 Channel Before Wiping Ukraine Grain Firm
• Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims
• University of Copenhagen data breach exposes data of 525,000 people
• ABC wipes staff devices exposed to new, sophisticated cyber attack - ABC News
• Samsung TVs might use the mics of connected devices to listen to you, researcher says

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Group-IB links k0t to Fortinet and Palo Alto edge-device compromises, while Bitdefender finds preinstalled malware on MediaTek Android phones in 150 countries.

Sources:

• Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
• Cheap Android phones found with malware already installed
• Chinese Hackers Breached Diplomatic Networks; Microsoft Baton Drop Enforcement Never Deployed
• Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt
• Quest Diagnostics confirms data breach exposed patient records
• Operation IXIM: Preventing a botnet of millions of Popcorn Time users - Eye Research
• A Botnet Used Poetry To Mine Crypto From Over 3,000 Servers - Here's How
• Breaking the AWS MCP Python Sandbox | xplo1t's site
• AI Agent Containment Fails at Every Stack Layer — Vector Wire
• Jaguar Land Rover cyber-attack was ‘state-sponsored’, former minister suggests
• Give that man a beer! Cheers Ond?ej Surý

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

GitLab fixes a CVSS 10.0 unauthenticated RCE, Railway tells all users to rotate keys, and Node2Shell hits Node.js.

Sources:

• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
• Developer platform Railway urges 'all users' to revoke secret keys after cyberattack | TechCrunch
• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix
• Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web · Forever Security
• Internet2's certificate authority (eMudhra) is being distrusted

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Critical PHP2Shell RCE hit honeypots 5.5 hours before fixes, a poisoned LiteLLM release stole credentials, and APT28 breached a NATO naval shipbuilder.

Sources:

• PHP2Shell: critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | ELLIO | ELLIO Blog
• Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source Software Supply Chain Security
• Russia Weaponized Microsoft Edge to Breach NATO Naval Shipbuilder in Two-Month Espionage Campaign
• FBI Warns SafePay Ransomware Has Hit 600 Organizations — Here’s How Businesses Can Protect Themselves
• Court Records Reveal DHS Lied About Motive in GrapheneOS Activist Border Case

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Compromised TLS certificates, a PAN-OS auth bypass exploited by ransomware gangs, and a backdoored OVHcloud CLI top today's security briefing.

Sources:

• The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica
• Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
• OVHcloud CLI releases backdoored on GitHub to steal developer secrets
• Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug
• How I got over 300 Tor exit nodes removed - KABA

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

FBI says ShinyHunters extorted over $70 million this year, and now a Canadian security executive faces charges tied to the group.

Sources:

• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security
• How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
• WordPress SEO plugin Rank Math compromised to backdoor websites
• F5 releases out-of-band patches for critical NGINX vulnerabilities
• New iPhone spyware can steal passwords and photos

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

BeyondTrust patches a critical zero-day used by a China-nexus actor, Oracle Health confirms 19.9 million patients exposed, and CERT-In says AI agents breached Indian firms undetected.

Sources:

• BeyondTrust patches zero-day exploited in attacks since August
• Oracle Health data breach exposes nearly 20 million patients
• India's CERT-In Confirms AI Agents Breached Firms Undetected — Vector Wire
• Microsoft disrupts Chinese-language phishing kits behind 1bn scam messages
• Just when we thought targeted ads couldn't get any worse, these were found serving malware
• PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | PWN.AI Security Research
• Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
• PSA: The calendar invite is the new phishing vector, and email filters aren't catching it
• Meta's smart glasses were recording conversations without the wake phrase, company admits | TechSpot
• Claude cracks 25-year NSA cryptography mystery in under 30 minutes
• The Danish National Registry Could Use A Lesson In How To Create A Strong Password
• Security fears in Norway as Chinese smart cars record sensitive military data
• KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | Group-IB Blog
• Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.