The Daily Index — Monday, January 5, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL VULNERABILITY IN IBM API CONNECT COULD ALLOW AUTHENTICATION BYPASS

IBM has disclosed CVE-2025-13915, a critical authentication bypass vulnerability with a CVSS score of 9.8 affecting API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0, that allows remote attackers to gain unauthorized access without user interaction. The flaw, classified as CWE-305, breaks the architectural assumption that API gateways enforce identity and trust, causing downstream services to inherit unvalidated trust and enabling silent exposure propagation across connected systems. Organizations should immediately apply IBM's interim fixes or disable self-service sign-up on the Developer Portal while conducting inventory assessments of API dependencies and monitoring for abnormal behavior to identify which services implicitly trust the gateway.

csoonline.com · 5 min

TLDR InfoSec

TOKYO FM DATA BREACH: HACKER CLAIMS OVER 3 MILLION RECORDS STOLEN

A threat actor using the alias "victim" claimed to have breached Tokyo FM Broadcasting Co., LTD. on January 1, allegedly exfiltrating over 3 million records containing names, email addresses, dates of birth, IP addresses, user agents, job-related information, and login IDs from multiple internal systems. The breach claims remain pending verification by security experts, though if validated, the exposed credentials and personal information pose significant risks for phishing attacks and credential stuffing. Potentially affected listeners should monitor their email for suspicious messages, implement unique passwords across services, and exercise heightened vigilance given the scope of compromised personally identifiable information.

hackread.com · 3 min

TLDR InfoSec

BLUETOOTH HEADPHONE JACKING: FULL DISCLOSURE OF AIROHA RACE VULNERABILITIES

Researchers discovered a series of vulnerabilities in the Airoha Bluetooth SoCs used in many true wireless earbuds, including those from Sony, Bose, and Marshall. The vulnerabilities include a lack of authentication when connecting a device over Bluetooth Classic or BLE, as well as the devices implementing a custom protocol, called RACE, which allows for reading and writing RAM. An attacker could chain these vulnerabilities to impersonate a user's headphones and then issue commands via a device's virtual assistant or eavesdrop on calls.

insinuator.net · 10 min

TLDR InfoSec

THE ROI PROBLEM IN ATTACK SURFACE MANAGEMENT

Attack Surface Management programs struggle to demonstrate ROI because they optimize for coverage metrics like asset counts and alerts generated rather than measuring actual risk reduction, creating a gap between effort and security outcomes. Traditional ASM implementations focus on discovery inputs while teams experience alert fatigue, long backlogs of unresolved assets, ownership confusion, and exposures that persist for months without clear evidence of improved security posture. Organizations should shift to outcome-based metrics, including mean time to asset ownership, reduction in unauthenticated state-changing endpoints, and time to decommission abandoned assets—measurements that directly correlate with exposure duration and demonstrate whether the attack surface is actually shrinking over time.

thehackernews.com · 9 min

TLDR InfoSec

PALO ALTO NETWORKS SECURITY-INTEL BOSS CALLS AI AGENTS 2026'S BIGGEST INSIDER THREAT

AI agents are increasingly embedded deep within corporate systems, automating tasks such as code review, alert triage, approvals, and even financial decisions, effectively acting with human-like privileges at machine speed. This makes misconfigurations and over-permissive “superuser” access especially dangerous, because a single prompt injection or tool-misuse bug can turn an agent into a silent insider capable of approving fraudulent transactions, exfiltrating data, or deleting backups. At the same time, these tools help defenders scale, triage noise, and think more strategically, so security leaders must strike a balance: apply least-privilege access, robust monitoring, and strong controls around internal LLMs and task-specific agents to harness benefits without enabling catastrophic abuse.

theregister.com · 5 min

TLDR InfoSec

PETLIBRO: YOUR PET FEEDER IS FEEDING DATA TO ANYONE WHO ASKS

Smart pet feeders from Petlibro had several serious security flaws that allowed attackers to log in to any account via a broken social-login flow, because the backend trusted client-supplied Google IDs rather than validating OAuth tokens. Attackers could then pull detailed pet profiles, enumerate devices, hijack feeders and cameras, and even harvest owners' recorded mealtime audio messages through poorly authorized APIs. The researcher disclosed six issues, received a small bounty and a post‑hoc NDA request, and criticized Petlibro for leaving the legacy authentication bypass live for weeks in the name of “compatibility” despite the risk to users and their pets.

bobdahacker.com · 9 min

TLDR InfoSec

APISEC.AI (PRODUCT LAUNCH)

APISec is a dynamic, AI-powered API red team that continuously scans APIs for vulnerabilities. It includes a browser extension called Bolt that dynamically discovers APIs during user browsing without requiring a MitM proxy.

apisec.ai

TLDR InfoSec

TWO US CYBERSECURITY PROFESSIONALS PLEAD GUILTY IN BLACKCAT/ALPHV RANSOMWARE CASE

Cybersecurity professionals Ryan Goldberg (former Sygnia incident response manager) and Kevin Martin (DigitalMint ransomware negotiator) pleaded guilty to deploying BlackCat/ALPHV ransomware against multiple US victims from April to December 2023, extorting approximately $1.2M in Bitcoin from a medical device company while sharing 20% of ransoms with operators. The defendants leveraged their cybersecurity expertise to conduct attacks against five companies, with Goldberg later fleeing to Paris after learning of FBI raids on co-conspirators and both facing potential 50-year sentences. The case highlights insider threat risks and the FBI's recommendation for organizations to exercise due diligence when engaging third-party incident response providers.

securityaffairs.com · 5 min

TLDR InfoSec

ON APPLES, ORANGES, AND CLASSICAL ML VERSUS LLM SECURITY PERFORMANCE

When classical ML-based security tools are compared against LLM-based security tools, the classical ML tools often have several advantages that skew the results. Classical ML tools are frequently trained on a portion of the dataset and then tested on the same data, whereas LLM tools are tested in a one-shot fashion. The ground truth may contain labeling errors that classical ML models replicate, and classical ML models require continuous retraining to maintain accuracy. Moving forward, we should develop security-focused foundational models to help overcome scalability issues and hallucinations.

substack.com · 4 min

TLDR InfoSec

PREDICTION: AI WILL MAKE FORMAL VERIFICATION GO MAINSTREAM

Formal verification is a highly specialized and time-consuming process of mathematically validating a system's behavior. The 8,700-line seL4 microkernel required 20 person-years and 200,000 lines of code in the Isabelle proof language, underscoring why formal verification remains largely an academic discipline at present. If we instead train users to write proper specifications for formal verification, it may be possible to use LLMs to generate proofs and reduce the barrier to formal verification.

martin.kleppmann.com · 5 min

TLDR InfoSec

RESECURITY SAYS SHINYHUNTERS FELL FOR HONEYPOT AFTER BREACH CLAIM

Resecurity has refuted ShinyHunters' breach claims, revealing that the threat actor interacted with a honeypot containing synthetic employee accounts and fake infrastructure rather than production systems.

hackread.com · 3 min

TLDR InfoSec

CALIFORNIA RESIDENTS CAN USE NEW TOOL TO DEMAND BROKERS DELETE THEIR PERSONAL DATA

California's new Delete Requests and Opt-Out Platform (DROP) lets residents file a single verified request to force over 500 registered data brokers to delete their personal data and stop selling it.

techcrunch.com · 3 min

TLDR InfoSec

COVENANT HEALTH DATA BREACH IMPACTS 478,000 INDIVIDUALS

Qilin ransomware actors breached Covenant Health's systems in May 2025, exfiltrating roughly 850 GB of data, including over 1.3 million files containing names, addresses, Social Security numbers, insurance details, and treatment information for 478,188 people across multiple US states.

securityweek.com · 2 min