Your Headphones Can Track and Spy on You — WhisperPair

Researchers from the Belgian university KU Leuven have uncovered a critical security flaw in Google Fast Pair technology that allows attackers to remotely take control of wireless headphones and speakers. The vulnerability, designated as CVE-2025–36911, affects devices from renowned manufacturers such as Sony, Google, JBL, Jabra, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, and Logitech. Google classified this flaw as critical and awarded researchers the maximum bounty of $15,000 for reporting it.

The core of the problem lies in the improper implementation of the Fast Pair protocol by accessory manufacturers. According to specifications, Bluetooth devices should only accept new pairings when in pairing mode. However, many popular products do not verify this security step at all. An attacker can therefore initiate pairing with a stranger’s device even when the victim has their headphones on their ears or in their pocket. The entire attack takes just ten seconds and can be executed from a distance of up to fourteen meters without any user interaction. A standard laptop or smartphone is all that’s needed to carry out the attack.

After successful pairing, the attacker gains full control over the compromised device. They can play sounds at maximum volume, eavesdrop on calls, or even record conversations through the built-in microphone. Researchers tested twenty-five different devices from sixteen manufacturers, and the attack succeeded on seventeen of them. Vulnerable products include the Sony WH-1000XM4, WH-1000XM5, WH-1000XM6, Google Pixel Buds Pro 2, JBL TUNE BEAM, Jabra Elite 8 Active, and Nothing Ear (a).

Even more concerning is the possibility of tracking victims’ locations. If a vulnerable device has never been paired with an Android phone, an attacker can add the accessory to the Google Find Hub network under their own account. The system then recognizes the attacker as the legitimate owner and allows them to track the victim’s movement. Although the user may receive an alert about unwanted tracking, the notification paradoxically displays their own device. Most people will dismiss the warning as a software bug, allowing the attacker to track the victim for an extended period.

It’s important to understand that the vulnerability resides in the firmware of the headphones and speakers themselves, not in phones. Therefore, simply updating Android or iOS is not sufficient. The only solution is to install a firmware update from the headphone manufacturer. Many manufacturers have already released patches, but not all devices have been fixed yet. Users are advised to check for update availability directly with their device manufacturer. The Fast Pair function cannot be disabled in accessories, making firmware updates truly the only possible protection.

Russian Cyberattack Threatens Polish Energy Grid

At the turn of 2024 and 2025, Poland faced the most serious cyberattack on its energy infrastructure in the country’s history. According to Polish Deputy Prime Minister and Minister of Digitization Krzysztof Gawkowski, Poland came very close to a nationwide power outage. The attack, which the Polish government attributes to Russian hacking groups linked to intelligence services, targeted electricity-generating equipment across the country.

Energy Minister Miłosz Motyka described the incident as the strongest attack on the Polish power generation system in recent years. Unlike previous cyberattacks that focused on large power plants or high-voltage transmission networks, this time hackers targeted individual solar farms, wind turbines, and other renewable energy sources. The attackers attempted to disrupt communication between energy generation equipment and grid operators. According to Prime Minister Donald Tusk, if their plan had succeeded, up to half a million Poles could have been left without electricity.

The Polish government unequivocally blames Russia for the attack. Gawkowski stated that everything points to Russian sabotage aimed at destabilizing the situation in the country. Prime Minister Tusk, while admitting they don’t have hard evidence, said many indicators point to groups directly connected with Russian intelligence services. Poland, as one of Ukraine’s staunchest allies, has long warned about the hybrid war waged by Moscow against Kyiv’s partners and supporters.

The attack fits into a broader context of Russian sabotage activities in Central Europe. Polish intelligence services have documented numerous cases where Russia recruits saboteurs for espionage and subversive actions, including mapping critical infrastructure and arson attacks. Recently, there was also sabotage on an important railway route connecting Warsaw with Ukraine, where explosive devices were meant to cause train derailment. These activities represent part of the hybrid warfare that the Kremlin is waging against Western states supporting Ukraine.

Microsoft Disrupts Global Cybercriminal Network RedVDS

In mid-January 2026, Microsoft, in cooperation with international law enforcement agencies, announced a significant success in the fight against cybercrime. The company disrupted the operations of RedVDS, a service that functioned as a prepaid platform enabling criminals to conduct fraud at scale. This coordinated action included legal proceedings in both the US and UK, marking Microsoft’s first civilian lawsuit filed outside American territory. Europol and German authorities also participated in the operation, seizing key servers.

RedVDS represented a typical example of the cybercrime-as-a-service model, which has become an increasingly significant threat in recent years. For just $24 per month (approximately 550 CZK), criminals could gain access to disposable virtual computers with unlicensed Windows software. These machines were then used for illegal activities. The service had been operating since 2019, and its operator is tracked by Microsoft under the designation Storm-2470.

The scope of damage caused through RedVDS is alarming. In the United States alone, reported losses reached approximately $40 million (nearly 920 million CZK), with actual figures likely much higher since many incidents remain unreported. Specific victims include Alabama pharmaceutical company H2-Pharma, which lost over $7.3 million intended for life-saving medications, and Florida homeowners association Gatehouse Dock, which was defrauded of nearly $500,000. Since September 2025, attacks using RedVDS have compromised or gained unauthorized access to more than 191,000 organizations worldwide.

A disturbing aspect of this case is the use of artificial intelligence to enhance fraudulent activities. Attackers combined RedVDS services with generative AI tools that helped them identify lucrative targets and create convincing phishing messages mimicking legitimate correspondence.

In Europe, attacks primarily targeted institutions in the United Kingdom, France, Germany, Italy, and Spain.

Critical Vulnerability in FortiSIEM

On January 13, 2026, Fortinet released urgent security updates for its FortiSIEM platform, fixing a critical vulnerability tracked as CVE-2025–64155. This severe flaw allows unauthenticated attackers to remotely execute arbitrary code on affected systems through specially crafted TCP requests. The vulnerability received a CVSS score of 9.4 out of 10, ranking it among the most serious security threats.

The vulnerability was discovered by security researcher Zach Hanley from Horizon3.ai, who responsibly reported it to Fortinet in August 2025. Technically, it’s an OS command injection vulnerability that arises from insufficient neutralization of special characters in user input. The issue affects the phMonitor service, a key FortiSIEM component responsible for data and command exchange between system components. This service listens on TCP port 7900 and exposes a set of command handlers that can be invoked remotely without any authentication.

Attackers can exploit this vulnerability to write arbitrary files to arbitrary locations in the FortiSIEM system in the context of the admin user. Subsequently, by overwriting scripts or binaries that are regularly executed, they can achieve remote code execution. Even more critically, attackers can then escalate privileges to root level through cron jobs that execute scripts writable by the admin user. The result is complete control over the entire FortiSIEM system, including the operating system.

The situation is further complicated by the fact that Horizon3.ai has published a proof-of-concept exploit, and security firm Defused already detected active exploitation attempts on January 15, 2026. The vulnerability affects FortiSIEM versions 6.7.0 through 7.4.0, while versions 7.5 and FortiSIEM Cloud are not affected.