The Daily Index — Wednesday, January 21, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

MINNESOTA DEPARTMENT OF HUMAN SERVICES DATA BREACH IMPACTS 300K

The Minnesota Department of Human Services is notifying 300K victims that their data was accessed by an unauthorized individual over the course of a month. A user affiliated with a licensed care provider accessed data in the MnCHOICES system without authorization. The data accessed includes names, sex, dates of birth, phone numbers, addresses, Medicaid ID numbers, and the last four digits of SSNs.

startribune.com · 2 min

TLDR InfoSec

APACHE AIRFLOW VULNERABILITIES ENABLE SENSITIVE DATA EXPOSURE

Two new vulnerabilities allow for sensitive data leakage in versions of Apache Airflow prior to 3.16. The first vulnerability arises from Airflow failing to properly mask proxy credentials in log files. The second vulnerability arises from Airflow not applying user-registered secret pattern masking before truncating field templates when dealing with long fields in the Rendered Templates UI.

cybersecuritynews.com · 2 min

TLDR InfoSec

HOW TO GET SCAMMED (BY DPRK HACKERS)

A security researcher documented a DPRK-linked Contagious Interview campaign in which threat actors posed as recruiters on Discord, delivering malware via fake technical assessments that deployed a multi-stage payload using blockchain-based dead-drop resolvers across Tron, Aptos, and Binance Smart Chain. The final RAT establishes persistence by injecting into VS Code and Cursor IDEs, exfiltrates credentials, and evades analysis by detecting cloud/CI/CD environments. Detection requires monitoring for Node.js processes that spawn with eval flags and API calls to blockchain endpoints such as api.trongrid.io.

links.tldrnewsletter.com · 18 min

TLDR InfoSec

CLANG HARDENING CHEAT SHEET - TEN YEARS LATER

Quarkslab has updated its Clang hardening cheat sheet after ten years, documenting new compiler mitigations including FORTIFY_SOURCE level 3, stack clash protection via -fstack-clash-protection, and Intel CET/ARM PAC+BTI for control-flow integrity. The guide covers defenses against ROP/JOP attacks through hardware-assisted mechanisms such as shadow stacks and indirect branch tracking, as well as speculative execution mitigations with -mspeculative-load-hardening. Security teams should adopt the OpenSSF-recommended compiler flags and consider architecture-specific protections (CET for x86 and PAC/BTI for ARM) while balancing performance trade-offs.

blog.quarkslab.com · 20 min

TLDR InfoSec

SOLYXIMMORTAL: PYTHON MALWARE ANALYSIS

SolyxImmortal is a Python-based spyware that targets Windows systems, focused on long-term surveillance and data theft rather than destruction. It steals browser credentials, harvests documents, logs keystrokes, and captures screenshots, then exfiltrates everything via hardcoded Discord webhooks over HTTPS to blend into normal traffic. It minimizes detection while continuously monitoring victims by persisting through AppData and Run keys, abusing DPAPI to decrypt Chromium credentials, and batching keystrokes and archives.

cyfirma.com · 12 min

TLDR InfoSec

org, take a look at the most trusted enterprise password manager

Summary unavailable

bitwarden.com

TLDR InfoSec

UK GAMBLING REGULATOR ACCUSES META OF LYING ABOUT ITS STRUGGLE TO SPOT ILLEGAL ADS

The UK Gambling Commission's executive director accused Meta of knowingly allowing illegal gambling advertisements, noting that its own searchable ad library reveals operators using keywords like "not on Gamstop" to target vulnerable users. Meta suggested the regulator deploy AI tools to find and report these ads rather than proactively policing its own platform. The commission's executive director described Meta's ad library as "a window into criminality" and said the company appears "happy to turn a blind eye and continue taking money from criminals."

theregister.com · 2 min

TLDR InfoSec

NORTH KOREA-LINKED HACKERS TARGET DEVELOPERS VIA MALICIOUS VS CODE PROJECTS

North Korean operators are posing as recruiters and sending developers fake coding tests that require cloning malicious Git repositories into VS Code. Once the project is opened and trusted, malicious tasks.json configurations fetch obfuscated JavaScript payloads from Vercel to install backdoors such as BeaverTail and InvisibleFerret, enabling remote code execution, keylogging, data theft, and crypto mining.

thehackernews.com · 3 min

TLDR InfoSec

WEAPONIZING CALENDAR INVITES: A SEMANTIC ATTACK ON GOOGLE GEMINI

A seemingly normal calendar invite hides a natural-language payload in the event description, which Gemini processes when a user later asks about their schedule. This triggers Gemini to summarize private meetings, write the summary into a new event visible to the attacker, and reply with a harmless message.

miggo.io · 8 min

TLDR InfoSec

CHATGPT HEALTH RAISES BIG SECURITY, SAFETY CONCERNS

OpenAI's ChatGPT Health product raises data privacy concerns by enabling medical record integration and third-party sharing without confirmed end-to-end encryption or HIPAA protections, and notably excludes regions with stricter data regulations, such as the EEA and the UK.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

COP COPS IT AFTER COPILOT COPS OUT: WEST MIDLANDS POLICE CHIEF QUITS OVER AI HALLUCINATION

West Midlands Police chief constable retired after the force used Microsoft Copilot's fabricated report about a non-existent football match to justify banning Israeli fans, highlighting the risks of AI hallucinations in law enforcement decision-making.

theregister.com · 2 min

TLDR InfoSec

WARWICKSHIRE SCHOOL TO REOPEN AFTER CYBERATTACK CRIPPLED IT

A Warwickshire secondary school is reopening after a severe cyberattack disabled critical IT and safety systems, including gates, fire alarms, registers, phones, and internet.

theregister.com · 4 min