The Daily Index — Monday, January 12, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

BREACHFORUMS HACKING FORUM DATABASE LEAKED, EXPOSING 324K ACCOUNTS

The latest version of the infamous BreachForums suffered a data breach that leaked a database of user accounts. The breached data includes display names, registration dates, IP addresses, and other internal information. Many of the breached users' IPs route to loop back, but over 70k records contain public IPs.

bleepingcomputer.com · 2 min

TLDR InfoSec

INSTAGRAM DATA LEAK EXPOSES SENSITIVE INFO OF 17.5M ACCOUNTS

Malwarebytes raised concerns about a trove of Instagram user information being sold on the dark web. The breached data includes usernames, emails, phone numbers, and partial location data. Instagram has stated that there was no data breach, but rather an issue that allowed external parties to send unrequested password reset emails.

cybersecuritynews.com · 2 min

TLDR InfoSec

ORM LEAKING MORE THAN YOU JOINED FOR

ORM Leak vulnerabilities extend beyond susceptible ORMs such as Django and Prisma to any application that implements robust filtering capabilities. This article details practical examples, including Harbor CVE-2025-30086 (Beego ORM) and authentication bypasses via Prisma operator injection via type coercion, and discusses multiple techniques for bypassing naive protections, including exploiting Beego's broken expression parsing, where non-relational fields in filter expressions are overwritten by subsequent fields. Semgrep detection rules for Django, Prisma, Beego, and Entity Framework ORMs have been published to help identify these commonly overlooked vulnerabilities.

elttam.com · 15 min

TLDR InfoSec

TWO CVES, ZERO EGO: A MAILPIT STORY

Mailpit is a lightweight email testing tool used in development that recently had two notable security issues uncovered: a server-side request forgery (SSRF) and a cross-site WebSocket hijacking (CSWSH) flaw. The SSRF bug allowed attackers to abuse a proxy endpoint to access internal services such as cloud metadata, while the WebSocket issue allowed any website to connect and stream all captured emails without authentication. The maintainer quickly fixed both issues in new releases and coordinated CVEs, showing how respectful communication, GitHub Security Advisories, and low-ego collaboration between researchers and developers lead to fast, effective vulnerability remediation.

rosecurify.com · 4 min

TLDR InfoSec

ATTACKERS LOVE YOUR GITHUB ACTIONS TOO

GitHub ranks as the second most used CI/CD tool, but it also exposes a large attack surface to attackers. GitHub Actions can unintentionally expose secrets or overprovision tokens. Actions are vulnerable to supply chain compromise via poisoned dependencies and injection attacks.

orca.security · 8 min

TLDR InfoSec

MUDDYWATER LAUNCHES RUSTYWATER RAT VIA SPEAR-PHISHING ACROSS MIDDLE EAST SECTORS

Iranian threat actor MuddyWater has been attributed to spear-phishing campaigns targeting diplomatic, maritime, financial, and telecom entities in the Middle East using a new Rust-based implant called RustyWater (also known as Archer RAT/RUSTRIC). The malware, delivered via malicious Word documents with VBA macros, establishes registry persistence and supports asynchronous C2 communication for file operations and command execution. This marks MuddyWater's continued evolution away from PowerShell and VBS loaders toward more structured, modular RAT capabilities.

thehackernews.com · 2 min

TLDR InfoSec

EUROPOL ARRESTS 34 BLACK AXE MEMBERS IN SPAIN OVER €5.9M FRAUD AND ORGANIZED CRIME

Europol and Spanish police have dismantled a major Black Axe cell in Spain, arresting 34 suspects across Seville, Madrid, Málaga, and Barcelona for cyber-enabled fraud and violent organized crime. Authorities link the Nigerian-origin syndicate to scams like business email compromise and romance fraud, with losses over €5.93 million, and report cash and bank account seizures alongside prior global crackdowns on the group.

thehackernews.com · 3 min

TLDR InfoSec

CYBERSECURITY CHANGES I EXPECT IN 2026

The primary cybersecurity question of 2026 will be whether an attacker's or defender's AI is more effective. Agentic security will encourage teams to build products rather than buy them, devalue junior employees, and lead to workplace upheaval. AI will also improve the efficacy of common security program weak points, such as secure code training and asset management.

danielmiessler.com · 10 min

TLDR InfoSec

ANTHROPIC: VIRAL CLAUDE "BANNED AND REPORTED TO AUTHORITIES" MESSAGE ISN'T REAL

Anthropic confirmed that a viral screenshot claiming Claude permanently banned a user and reported them to authorities is fake, noting the recurring hoax doesn't match any actual system messages.

bleepingcomputer.com · 1 min

TLDR InfoSec

MICROSOFT MAY SOON ALLOW IT ADMINS TO UNINSTALL COPILOT

Microsoft is testing a new RemoveMicrosoftCopilotApp group policy in Windows 11 Insider builds that allows IT administrators to uninstall the Copilot app on managed devices via Intune or SCCM.

bleepingcomputer.com · 2 min

TLDR InfoSec

INSTAGRAM SAYS IT FIXED THE ISSUE THAT LET SOMEONE SEND ALL THOSE PASSWORD RESET EMAILS

Instagram acknowledges that an external party exploited a flaw to trigger mass password reset emails, but insists there was no breach and that accounts remain secure, advising users to ignore the notifications

theverge.com · 1 min