HeadFlash Security

Palo Alto patches a PAN-OS zero-day under active exploitation, while the FBI seizes 187 laptops in a North Korean IT worker crackdown.

Sources:

• Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
• Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
• FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
• Fake Arch Linux packages push malware with root privileges
• Experts uncover bizarre new malware that spooks users with jump scares and screams

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Bitdefender says thousands of low-cost Android devices shipped with firmware malware; Cisco and Microsoft also patch actively exploited zero-days.

Sources:

• Low-cost Android phones ship with residential proxy malware
• Cisco patches new Secure Email Gateway zero-day exploited in attacks
• Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack
• Google’s new scam defenses on Android can hide your bank details and hang up on fraudsters
• Russia Compromised Signal Accounts in Five NATO Nations; Czech Republic Confirms Breach

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Ivanti patches an actively exploited zero-day as attackers turn French supermarket fridges into furnaces and npm trust flaw exposed 1,500 packages.

Sources:

• Ivanti warns of Connect Secure zero-day exploited in attacks
• Hackers Turn French Supermarket Refrigerators Into Furnaces
• Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover | HackerNoon
• Releasing the Cobalt Strike Beacon Corpus – Fox-IT International blog
• Flock can now issue CVEs for its own products. Should we trust it? | CyberScoop

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

GitLab rushes a max-severity RCE fix, Telegram closes a one-click account takeover, and Bitdefender finds malware baked into budget phones.

Sources:

• GitLab warns of max severity code execution vulnerability
• Telegram Desktop: one-click account takeover via IPC injection | beaksec
• How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck
• Experts warn cheap Android phones are being shipped with malware built in, so be on your guard
• Hackers hide behind Microsoft's own websites to get past email filters and launch phishing campaigns

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Ledger probes backdoored wallets from a Southeast Asia reseller as $71.5M sits in flagged addresses and a hidden implant is described.

Sources:

• Ledger's Crypto Wallets Reportedly Backdoored, $71 Million in Crypto Already Moved
• Dutch Intelligence: Chinese Malware Survives Firmware Patches, Compromised 20,000 Edge Devices
• Beijing Firm Integrity Technology Group Hacked Government Email, Built Third-Party Portal
• Leaked Chats Show a Russian Extortion Gang Sending Fake IT
• Cyberattack on Korean megachurches may have exposed 850K members
• ARTEX AI, Claude agents used in cyberattacks on South Korean banks
• FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
• XRP Bug Could Have Let Hackers Print Billions in Crypto Out of Thin Air
• Hackers use security cameras to track troops, military targets in Israel, Ukraine - report
• Spoofed store discount ads on Facebook and TikTok can steal card details in real time, report warns
• Canadian YouTuber builds 'Flock-like' camera to exclusively track police vehicles
• Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
• Bihar CM directs strict action against criminals, anti-social elements
• In the Netherlands and Belgium, Hans Anders pulls Meta's Ray-Ban smart glasses over privacy fears

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

US prosecutors unseal seizure of Integrity Technology Group domains used to scan and breach power companies, airports and universities worldwide.

Sources:

• FBI Seizes Domains Used in Flax Typhoon Attacks
• Researchers uncover new DarkSword spyware variant affecting unpatched iPhones
• Anthropic launches free AI security scans for open-source projects
• Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027
• CVE-2026-47483: NVIDIA DCGM Exporter Vulnerability Exposes GPU Servers | LAVA

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Atlassian's unauthenticated 9.3-rated flaw forces emergency upgrades, while the FBI and France take down two deepfake CSAM sites and arrest an admin.

Sources:

• Atlassian’s critical flaw turns eight enterprise products into one big security problem | CSO Online
• FBI, French authorities seize deepfake CSAM-for-sale websites
• Ransomware recovery CEO charged over secret ransom payments
• PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
• Hackers obtain counterfeit TLS certificates for Google and other large services - Ars Technica

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

FortiBleed is still locking Fortinet users out and feeding ransomware crews, while Denmark, Arizona, Georgia Power and one vengeful engineer round out today's security ledger.

Sources:

• Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
• Danish data breach: Everything we know about the cyber attack that hit 8.8m Danes
• Arizona Court Cyberattack Exposes Data on 1.3 Million People
• Georgia Power says hackers accessed 400,000 customer accounts
• Engineer sentenced for locking over 3,000 devices on employer network

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

A critical KVM zero-day confirmed by Vercel allows full VM escape to host root across tenants, sparking debate over the $50,000 bounty.

Sources:

• KVM zero-day vulnerability enables VM escape to host root | Cybernews
• Windows malware uses Grok AI to help stay hidden, researchers say
• Hackers Breached Propulsion System of US-Bound Oil Tanker
• New Dell System Update flaw lets hackers gain root privileges
• Trump Mobile’s latest problem: Hackers just released customer information

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Fortinet scrambles as attackers backdoor FortiMail gateways via a 9.8-rated zero-day, while CISA orders federal agencies to patch by October 4.

Sources:

• Hackers Backdoor Fortinet FortiMail Email Gateways With No Password; Patches Unavailable
• Microsoft 2026 Security Report: Autonomous Ransomware Has Hacked Real Organizations
• Warlock ransomware breach SharePoint in water, telecom operator attacks
• Android malware can steal your PIN and bank logins
• Your used CPU might come with someone else’s Valorant ban
• CVE-2026-93355: Account Takeover in LiteLLM | OX Security
• Malicious VPN config files can let attackers run commands on Asus routers
• Federal judge calls Flock ‘indiscriminate mass surveillance’
• Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea
• FBI Arrests First Ever Cyber Fugitive on Top 10 Most Wanted List
• Citrix patches NetScaler SAML zero-day exploited in attacks
• Police dismantle KillSec ransomware gang allegedly led by 16-year-old
• Chinese Hackers Impersonate Anthropic Employee to Extract AI Secrets
• Mac malware can hide commands in your iCloud calendar
• Iranian national extradited to US over alleged $3.4 billion state-backed hacking campaign in rare legal win for law enforcement

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.