HeadFlash Security

eSentire says attackers chained two PaperCut MF zero-days, a Java loader and a trojanized Copilot binary to reach a domain controller.

Sources:

• PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | eSentire
• From: [email protected] - Spoofing Arbitrary Apple iCloud Identities - SEC Consult
• Kevin Mandia’s new ‘agent swarm’ security startup Armadin raises $255.5M at $2.5B valuation
• Microsoft says threat actors are ahead in the early AI race
• Amnesty Report Documents Morocco's Sustained Spyware Campaign Against Civil Society

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Cloudflare bets on Merkle Tree proofs to replace quantum-vulnerable certificate chains, with issuance set to begin in early 2027.

Sources:

• Pwnd Blaster: Hacking your PC using your speaker without ever touching it | nns.ee
• New macOS malware masquerades as Zoom installer
• Russian state hackers use new RedFlick technique to push malware
• TeamViewer urges users to patch severe flaws “as soon as possible”
• Cloudflare plans to issue quantum-safe TLS certificates

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

New BTR variant defeats assumptions about self-modifying code, exposing root password hashes on Intel Linux systems in as little as three minutes.

Sources:

• New Spectre v2 attack variant leaks Linux root password hash in minutes
• A Realistic Code Execution Exploit Chain in OpenBao and Vault
• Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond
• Suspected ShinyHunters leader arrested in the Netherlands
• 80 Days Reverse Engineering an IoT DVR: What I Found and Why It Didn't Work Out — Leviathan OffSec

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

FBI assesses ShinyHunters breach of applicant portal, Pentagon confirms 2.76M records exposed, and an unpatched Windows 0day surfaces.

Sources:

• FBI grapples with fallout from massive data breach
• Pentagon breach exposed sensitive data on nearly 3 million people
• Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4) | Datadog Security Labs
• Escalating Windows Privileges: Exploiting NCSI Vulnerabilities
• Sender spoofing in Proton Mail via display-name homograph | protonmail-sender-spoofing

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

OpenAI pauses its most advanced model training after agents escaped a secure sandbox and reached the internet via DNS, the second such incident in three months.

Sources:

• OpenAI says its AI agents escaped a secure ‘sandbox’ again last weekend and is pausing training for a second time
• EX-ARRR: Sailing the 0-click Seas - ironPeak Blog
• Researchers Warn of Citrix NetScaler Exploitation - Decipher
• How I Could’ve Accessed 17 Trillion Microsoft Records | blog.faav.net
• There's a new way to break RSA that's faster than anything we've seen before - Ars Technica
• WhatsApp malware campaign uses DLL sideloading and BYOVD to target business users
• Hackers took home a stolen Flock camera. What they found was massive
• Rydox marketplace admin pleads guilty, faces 22 years in prison
• Scammers are going after young Roblox players and their Robux
• How CISA plans to shake up the CVE program
• EDR Evasion: Process Injection Without WriteProcessMemory
• Refrigerator Malfunctions Cause National Security Concerns
• CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
• I Told an AI Agent to Rob My Store. It Found 39 Ways to Do It | HackerNoon
• Chinese hackers targeted shipping in at least seven EU countries, cyber agency reports – POLITICO

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Researchers forged 1024-bit RSA signatures without factoring the key, and Iran-linked CHOSEN BRICK spyware targeted dissidents in a joint US-UK-Dutch alert.

Sources:

• Forging 1024-bit RSA signatures in nearly SNFS time
• Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ | The Record from Recorded Future News
• Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL | nns.ee
• Phone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges
• A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight | WIRED

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

ShinyHunters says it hacked the FBI through an unpatched Oracle PeopleSoft zero-day, stole up to 3TB, and defaced the FBI jobs site.

Sources:

• ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
• NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
• Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
• F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
• Homeland Security is monitoring activists building anti-flock tech

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.

Sources:

• vCenter pre-auth RCE: CVE-2026-59309/59310 | Mobeta
• GitHub App Private Keys: 474 Leaked Keys Still Work
• New ClosedQuorum Windows malware uses AI for attack decisions
• Stolen passwords are exposing America’s water providers to hackers
• D-Link warns of max severity zero-day bug in DIR-822A routers

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

A 14-year-old kernel race condition, an ebtables out-of-bounds write and a kTLS logic flaw are under active attack, with federal fixes due today.

Sources:

• CISA alerts of active exploitation of three Linux kernel flaws
• Hackers are hiding malware on blockchains that are nearly impossible to take down, and unrestricted AI models have pushed these attacks up 440%
• WordPress Click2Shell flaw lets hackers execute PHP on the server
• Downloading Zoom or Brave? Could Be New Mac Malware ‘Sonoma’ In Disguise | HackerNoon
• ShinyHunters says it hijacked Cl0p’s dark web leak site

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Check Point patches a critical root RCE, Docker fixes a Mac sandbox escape, and North Korea's WaterPlum breached 30,000 devices in 100+ countries.

Sources:

• New Check Point flaw lets hackers execute code with root privileges
• Guest to host: escaping Docker's hypervisor — Accomplish Blog
• North Korean WaterPlum hackers infected 30,000 devices worldwide
• An undercover Google analyst infiltrated a notorious supply-chain hacking gang
• Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
• Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
• Malicious npm packages evade install-script defenses at runtime
• Infected PHP Themes on Streaming Sites: The iOS Chain That… | DeafNews
• Slovakia discovers Russian backdoors in 279 new traffic cameras — SMS-triggered shell access and passwordless live feeds found in EU-funded rollout | Tom's Hardware
• SolarWinds Patches Hard-Coded Cryptographic Key in ARM:… | DeafNews
• We got a cybersecurity expert to hack this BYD. It was too easy
• MFA Won't Save You From OAuth Consent Abuse
• European Password Manager Shares Origins and Updates with State-Certified Russian Firm - VSquare.org
• Five Suicides in Five Weeks: Cyber Command Had Prior NDAA Fix; Funding May Not Follow

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.