The Daily Index — Monday, January 26, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FORTINET ADMITS FORTIGATE SSO BUG STILL EXPLOITABLE DESPITE DECEMBER PATCH

Attackers can still exploit a critical FortiCloud SSO authentication vulnerability in FortiOS, even on systems fully patched in December, by abusing a new SAML-based SSO attack path. Recent campaigns involve automated reconfiguration of FortiGate firewalls, the creation of backdoor admin accounts, and the theft of configuration files. Fortinet has urged customers to monitor authentication logs, restrict management exposure, and track admin changes while it develops a new fix.

theregister.com · 3 min

TLDR InfoSec

ANCIENT TELNET BUG HAPPILY HANDS OUT ROOT TO ATTACKERS

A critical (CVSS 9.8) vulnerability in telnet could allow unauthenticated users to obtain root privileges on systems running InetUtils telnetd. To exploit the vulnerability, an attacker only needs to set their USER environment variable to “-f root” and pass the “-a” or “--login” flag to telnet. Experts recommend updating to the latest version of telnet or, ideally, switching to a more secure protocol such as SSH.

theregister.com · 2 min

TLDR InfoSec

KUBERNETES V1.35: A BETTER WAY TO PASS SERVICE ACCOUNT TOKENS TO CSI DRIVERS

Kubernetes v1.35 added the ability for CSI drivers to opt-in to receiving service account tokens via the `secret` field in `NodePublishVolumeRequest`. Prior to this update, service account tokens were received via the `volume_context` field, which could lead to secrets being included in gRPC request logs if drivers did not implement custom sanitizer logic. To opt in to this feature, CSI drivers should implement the `serviceAccountTokenInSecrets' field as well as implement logic for backwards compatibility.

kubernetes.io · 4 min

TLDR InfoSec

BUILDING TAMPER-PROOF MEDIA APPS: C2PA VS CPP DEEP DIVE FOR DEVELOPERS

This technical deep dive compares C2PA (the industry standard backed by Adobe and Sony) with the emerging Content Provenance Protocol (CPP) for building tamper-proof media applications that prove content authenticity. CPP's key differentiator is its "Completeness Invariant," which uses XOR hash sums to mathematically detect deleted evidence—a critical capability for legal proceedings, insurance claims, and regulatory compliance that C2PA cannot provide architecturally. The article provides Swift and Python implementations of cryptographic patterns, including Secure Enclave signing, Merkle tree construction, RFC 3161 timestamp anchoring, and privacy-preserving human attestation without storing biometric data.

dev.to · 14 min

TLDR InfoSec

THE DUAL-USE DILEMMA OF AI: MALICIOUS LLMS

While LLMs can be a useful tool for defenders, they can also be used by attackers. WormGPT was the first malicious LLM that was released. It is still being developed. KawaiiGPT is an open-source malicious LLM. This article analyzes the efficacy of these models at producing ransomware notes, data exfiltration scripts, and lateral movement detection.

unit42.paloaltonetworks.com · 13 min

TLDR InfoSec

MICROSOFT GAVE FBI A SET OF BITLOCKER ENCRYPTION KEYS TO UNLOCK SUSPECTS' LAPTOPS

The FBI has obtained a warrant compelling Microsoft to hand over BitLocker recovery keys for three seized laptops, allowing agents to decrypt the drives despite full‑disk encryption. BitLocker recovery keys are often stored in Microsoft's cloud, enabling lawful access but also raising privacy and security fears if the company or its keys are compromised.

techcrunch.com · 3 min

TLDR InfoSec

MICROSOFT FLAGS MULTI-STAGE AITM PHISHING AND BEC ATTACKS TARGETING ENERGY FIRMS

Microsoft describes a layered phishing and BEC campaign against energy companies that abuses trusted services like SharePoint and OneDrive to deliver links leading to adversary-in-the-middle credential theft pages. Attackers then use stolen credentials and session cookies to set stealthy inbox rules, launch large internal and external phishing waves, and bypass MFA using tailored phishing kits and social engineering, prompting defenders to adopt phishing-resistant MFA, conditional access, continuous access evaluation, and robust anti-phishing controls.

thehackernews.com · 4 min

TLDR InfoSec

IRELAND WANTS TO GIVE ITS COPS SPYWARE, ABILITY TO CRACK ENCRYPTION

Ireland has announced the release of a new communications bill that seeks to provide sweeping updates to its decades-old telecommunications legislation. Among the provisions in the bill, Ireland is looking to provide law enforcement with the ability to utilize spyware as well as the ability to intercept encrypted messages. Ireland is looking to follow the framework laid out by the EU Commission in 2024.

theregister.com · 4 min

TLDR InfoSec

ANTHROPIC PREPARES TO RELEASE SECURITY CENTER FOR CLAUDE CODE

Anthropic is preparing to launch Security Center for Claude Code, a feature that will provide users with an overview of recent security scans, detected issues, and the ability to manually initiate repository scans.

testingcatalog.com · 2 min

TLDR InfoSec

GMAIL GLITCH APPEARS TO BREAK EMAIL FILTERING, TABBED INBOXES

Google resolved a Gmail glitch that caused marketing and promotional emails to flood users' Primary inboxes instead of being routed to the Promotions tab.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

1PASSWORD ADDS POP-UP WARNINGS FOR SUSPECTED PHISHING SITES

1Password will now display pop-up warnings when users attempt to enter credentials on typosquatted or suspected malicious domains that don't match URLs stored in their vault.

bleepingcomputer.com · 2 min