The Daily Index — Friday, January 9, 2026 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

SCHEDULE A DEMO →

Summary unavailable

vectra.ai

TLDR InfoSec

ESA CALLS COPS AS CRIMS LIFT OFF 500 GB OF FILES, SAY SECURITY BLACK HOLE STILL OPEN

The European Space Agency faces a new breach after Scattered/Shiny Lapsus$ Hunters claimed to have stolen 500 GB of highly sensitive operational, spacecraft, and contractor data from ESA systems, including information on missions involving partners such as SpaceX and Airbus. The attackers say their access remains open. The ESA has referred the case for a criminal inquiry amid a history of prior security incidents dating back to 2011.

theregister.com · 2 min

TLDR InfoSec

CRITICAL JSPDF FLAWS LETS HACKERS STEAL SECRETS VIA GENERATED PDFS

The popular jsPDF library is vulnerable to a local file inclusion and path traversal attack that can allow attackers to steal secrets. The flaw allows attackers to pass unsanitized paths directly to the loadFile function or any functions that call it. The vulnerability was fixed in version 4.0.0, but it may not be comprehensive on Node 20 and earlier.

bleepingcomputer.com · 2 min

TLDR InfoSec

DECODING THE GITHUB RECOMMENDATIONS FOR NPM MAINTAINERS

Following recent npm supply chain attacks, GitHub's hardening guidance centers on three controls: adopting Trusted Publishing Framework (OIDC-based short-lived credentials instead of long-lived tokens), enforcing 2FA for all publishing operations, and using WebAuthn/passkeys instead of TOTP for phishing-resistant authentication. npm deprecated new TOTP setups in October and disabled legacy tokens in November, requiring maintainers to use granular access tokens with expiration for CI/CD automation. Maintainers should configure trusted publisher relationships in package settings, enable 2FA across all sensitive operations, and enroll WebAuthn authenticators while maintaining repository access controls.

securitylabs.datadoghq.com · 13 min

TLDR InfoSec

DO SMART PEOPLE EVER SAY THEY'RE SMART? (SMARTERTOOLS SMARTERMAIL PRE-AUTH RCE CVE-2025-52691)

A critical pre-auth remote code execution flaw (CVE-2025-52691) in SmarterTools SmarterMail, a business email and collaboration server for Windows and Linux, arises from an unauthenticated file upload endpoint that accepts attacker-controlled parameters. It includes a GUID used to construct file paths, enabling arbitrary file writes via path traversal and by crafting a multipart/form-data request with specific context and contextData values. With a malicious file, an attacker can place a web shell in the webroot and gain full remote code execution.

labs.watchtowr.com · 14 min

TLDR InfoSec

THE LOG RINGS DON'T LIE: HISTORICAL ENUMERATION IN PLAIN SIGHT

Logs are an essential tool for defenders to monitor for breaches and investigate incidents. However, they can also be a valuable enumeration tool for attackers. This article provides a comprehensive overview of how attackers can abuse logs for enumeration in AWS, Azure, and GCP. Security teams should treat logs with care and enforce the principle of least privilege where possible.

exaforce.com · 12 min

TLDR InfoSec

BLACKBIRD.AI (PRODUCT LAUNCH)

Blackbird.AI provides an AI-powered narrative intelligence platform that helps organizations detect, analyze, and respond to harmful or misleading online narratives and influence campaigns that threaten reputation, operations, and security.

blackbird.ai

TLDR InfoSec

KERNEL BUGS HIDE FOR 2 YEARS ON AVERAGE. SOME HIDE FOR 20

Analysis of 125,183 Linux kernel bugs with Fixes: tags revealed an average bug lifetime of 2.1 years, with race conditions averaging 5.1 years, and the longest-lived bug persisted for 20.7 years. Detection rates improved dramatically, from 0% bugs found within one year in 2010 to 69% in 2022, driven by tools such as Syzkaller and kernel sanitizers. The VulnBERT model achieved 92.2% recall and a 1.2% false-positive rate by combining CodeBERT embeddings with 51 handcrafted features targeting patterns such as unbalanced refcounts and missing NULL checks.

pebblebed.com · 18 min

TLDR InfoSec

CHATGPT FALLS TO NEW DATA-PILFERING ATTACK AS A VICIOUS CYCLE IN AI CONTINUES

Security researchers at Radware show how a new “ZombieAgent” attack revives a previously blocked ChatGPT data‑exfiltration technique by tweaking prompts to bypass URL restrictions and leak information character by character. Indirect prompt injection and weak separation between user instructions and embedded content keep LLM agents vulnerable, forcing vendors into an endless patch-and-bypass cycle rather than a fundamental fix.

arstechnica.com · 4 min

TLDR InfoSec

WHY WE'RE TAKING LEGAL ACTION AGAINST SERPAPI'S UNLAWFUL SCRAPING

Google filed a lawsuit against SerpApi for circumventing security measures through bot networks, cloaking techniques, and fake crawler identities to scrape and resell copyrighted content from search results.

blog.google · 1 min

TLDR InfoSec

MAJOR DATA BREACH HITS COMPANY OPERATING 150 GAS STATIONS IN THE US

Gulshan Management Services, operator of Handi Plus and Handi Stop gas stations, disclosed a September 2025 breach exposing SSNs, financial data, and government IDs of 377,000+ individuals.

hackread.com · 2 min

TLDR InfoSec

COOLIFY DISCLOSES 11 CRITICAL FLAWS ENABLING FULL SERVER COMPROMISE ON SELF-HOSTED INSTANCES

Cybersecurity researchers reveal 11 critical vulnerabilities in Coolify, a popular self‑hosting platform, that enable authenticated low‑privileged users to achieve root command execution, escape containers, and even obtain the server's root SSH key, potentially compromising entire infrastructures.

thehackernews.com · 4 min