HeadFlash Security

Hundreds of fake VPNs target Russian users, plus a massive data breach revision and new charges in a $6M Bitcoin extortion case.

Sources:

• Hundreds of Fake VPNs Are Flooding the Chrome Web Store
• Iranian Hackers Tied to $6 Million Bitcoin Extortion Charged in Massive Cyber Campaign
• Nearly 2,000 Hacked WordPress Sites Turned Into Criminal Infrastructure
• Data belonging to 3.75 million patients was exposed in the CareCloud breach – not the 350,000 originally reported
• US says hackers are targeting vulnerable water systems with the help of AI

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Japanese cloud provider Sakura Internet says hackers accessed its sales system, potentially compromising up to 1.36 million member accounts.

Sources:

• Sakura Internet hack exposes data of up to 1.36 million accounts
• Russia's GRU Hacked Ukraine's Sanctioned-Asset Agency Days Before $165M Deadline
• Apple Just Fixed 29 Security Flaws Across iPhone, iPad, and Mac, Including One That Could Expose Your Network Traffic to Attackers
• ClarityCheck people-finder left millions of face photos exposed, likely without their knowledge
• CISA: Medusa ransomware hit over 500 critical infrastructure orgs

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

CISA flags CVE-2025-60710 as abused by ransomware; a single operator compromises over 14,000 Dahua cameras in Ukraine and Russia.

Sources:

• CISA: Windows Task Host flaw now exploited by ransomware gangs
• Kimi Desktop Ships With a Group Chat Updater That Can Install Unverified Code
• Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia
• China-Linked APT Uses AI to Optimize Hand-Built Malware
• Chainalysis Sues US Government Over $94.6M ICE Contract Handed to Rival TRM Labs

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Unauthenticated RCE in CircleCI MCP server, NYC permit portal IDOR fixed, passkey bypasses, EncroChat malware origin, French tax data breach.

Sources:

• Unauthenticated RCE in CircleCI MCP Server Explained
• Hacking the New York City Building Permit Portal | Michael Cummings
• Passkey Bypass: Three Attacks Demolish Phishing-Resistant… | DeafNews
• Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network | Computer Weekly
• France’s tax agency lost data on 678,000 people to a stolen login

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Coldcard wallet exploit drains $130M in Bitcoin, Clop hits Shell and GE, and macOS Screen Sharing flaw mines Monero.

Sources:

• Hackers drained $130 million in Bitcoin from 7,300 'cold' wallets once billed as secure
• Clop Hacks Shell, GE, Philips in 43-Victim PTC Windchill Zero-Day Campaign
• macOS Screen Sharing Flaw Actively Exploited to Mine Monero: Patch Now
• Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam
• Metabase Zero-Day CVE-2026-72898: Active Exploitation, CVSS… | DeafNews
• NHS Blood and Transplant investigate data breach due to pager use
• Expired domains are a goldmine for hackers – and some cyber crime groups are investing millions in 'dropcatch' scams to deliver malware
• A phone company just lost 1.6 million records to a phone call
• McDonald’s employee data listed for sale in wider Entra campaign | Ransomnews
• New Evooo1Bot Linux botnet turns routers into traffic relay nodes
• CVE-2026-33696: From a Schema Name to RCE in n8n | Simon Koeck
• Removing Exif Data Is No Longer Enough. AI Can Now Tell Where Your Photos Are Taken Without It
• U.S. courts will now make government use of spyware tools public

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Lazarus exploits a fresh Windows flaw, AI agents autonomously hit Taiwan agencies, and more in today's security brief.

Sources:

• Microsoft issues emergency patch as North Korean hackers caught exploiting dangerous flaw
• Open-Source AI Agents Breach Taiwan Nuclear Agency in Four-Day Autonomous Strike
• Bloom Security’s Extension Resurrection research exposes a blind spot in developer security
• 'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft
• PSA: Don't trust that Chrome update popup — it could be malware

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Hudson Rock maps the largest AI supply chain breach to date: LiteLLM compromise hits AWS, Samsung, Cisco and thousands more.

Sources:

• Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises - Claim Your Ethical Disclosure | InfoStealers
• Android malware combo takes out loans and relays victims' credit cards
• Lazarus Group Hacked Defense Workers With Windows Kernel Zero-Day for Five Weeks
• Signal adds new security feature to thwart man-in-the-middle attacks
• This Coin-Sized Device Can Hack a Boeing 737 | WIRED

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Docker patched a container-to-host escape; Zoom fixed a zero-click RCE affecting all platforms. Also: Polish power plant breach, DeadLock's blockchain C2.

Sources:

• CopyEscape: Taking Over Docker Hosts with docker cp | Imperva
• Ⓐ Cyber Security | Blog | ZOOMSDAY
• Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
• DeadLock Ransomware Hides C2 on Polygon Blockchain, 80-Plus Victims Hit
• Poland's Water Hack Prosecution Names Russians But Can't Reach Them: Default Passwords Opened Plants
• Inside the BBC’s emergency plans for a Putin cyber attack
• New Zealand Targets Russian Cyber Actors With Fresh Sanctions
• BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

OpenAI's new offensive-security model finds real Chrome zero-days, while Daybreak tiers open for defenders and researchers.

Sources:

• OpenAI launches GPT-5.6-Cyber to help defenders find vulnerabilities before attackers do

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.

Hidden backdoor in 20+ Zbtlink router models allows root access to an estimated 100,000 devices worldwide.

Sources:

• Chinese Router Backdoor Opens Root Access on 100,000 Devices Worldwide – SOFX
• Trustfall: An RSA Heap Underwrite Into OP-TEE's Secure World · ByteRay Blog
• tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open | bobdahacker
• The npm attack that turned provenance attestations into camouflage
• Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs
• 8 out of 10 Banks in Belgium HATE This One Weird eID RCE - Am I Being Pwned?
• RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data
• Hackers breach TrueConf to trojanize client installers with backdoors
• Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers
• Researchers wiretapped a whole neighborhood's fiber internet from home
• MIT researchers found a new Spectre attack that can slip past Intel and AMD defenses
• Experts warn this fake Claude install guide can be used to empty crypto wallets
• Self-destructing phone code sparks federal case
• Bypassing Windows application whitelisting | dotSec

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.