The Daily Index — Wednesday, February 18, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

INDIAN PHARMACY CHAIN GIANT EXPOSED CUSTOMER DATA AND INTERNAL SYSTEMS

A misconfigured “super admin” interface at DavaIndia Pharmacy, part of Zota Healthcare, allowed anyone to create high-privilege accounts and access data on nearly 17,000 online orders across 883 stores, including names, contacts, addresses, and purchased medicines. Attackers could have altered pricing, discounts, and prescription requirements before the flaw, reported to CERT-In in August 2025, was quietly fixed.

techcrunch.com · 2 min

TLDR InfoSec

HOW A SINGLE TYPO LED TO RCE IN FIREFOX

A single-character typo (using `&` instead of `|`) in a SpiderMonkey Wasm GC array refactoring commit introduced a use-after-free vulnerability in Firefox's renderer process, enabling arbitrary read/write primitives and full code execution. The bug caused out-of-line array forwarding pointers to be incorrectly zeroed during garbage collection, allowing attackers to reclaim freed memory via heap spraying, bypass ASLR through pointer leaks, and hijack control flow. The vulnerability affected only Firefox 149 Nightly and was patched within six days of the report. No release versions were affected.

kqx.io · 11 min

TLDR InfoSec

INSIDE BASHE: THE INTERVIEW WITH THE RANSOMWARE GROUP KNOWN AS APT73

Bashe (formerly APT73) is a RaaS group rebranded around a Chinese mythological serpent identity. It operates with a 0.25 BTC affiliate entry fee as both a monetization and anti-infiltration measure, and collaborates with initial access brokers and disgruntled corporate insiders. The group claims full-stack encryption, EDR bypass capabilities, and centralized control over negotiation panels and data publication timers, while excluding healthcare, schools, and CIS countries from targeting. This pattern is consistent with norms in the Russian-speaking ransomware ecosystem. Their deliberate vagueness on technical specifics such as key management architecture, combined with profit-first rhetoric and a shifting geographic focus toward countries with higher payment rates, provides useful threat intelligence for defenders modeling RaaS operator behavior.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

BREAKING EBPF SECURITY: HOW KERNEL ROOTKITS BLIND OBSERVABILITY TOOLS

Research has shown that kernel rootkits can systematically blind eBPF-based security tools by using ftrace to hook the data-delivery plumbing, BPF iterators, ring buffers, perf events, and map operations, rather than targeting the eBPF programs themselves. The Singularity rootkit selectively filters hidden processes and network connections at the kernel-to-userspace boundary, causing security tools to operate on a fabricated view of system state while believing they have complete visibility. The findings underscore that eBPF observability assumes a trusted kernel, and defenders must prioritize preventing kernel compromise through Secure Boot, signed module enforcement, and layered out-of-host detection rather than relying solely on kernel-level telemetry.

matheuzsecurity.github.io · 16 min

TLDR InfoSec

A STANDARDIZATION GUIDE TO PROMPT INJECTION

Lasso proposes a structured taxonomy for prompt injection, distinguishing between attacker intent (system prompt leakage vs. jailbreak) and text-based techniques, including instruction override, role-playing, and others. Each category includes concrete subtypes and examples to help practitioners more reliably detect, reason about, and defend against modern LLM prompt attacks.

lasso.security · 11 min

TLDR InfoSec

secure your apps with Azure >

Summary unavailable

links.tldrnewsletter.com

TLDR InfoSec

VULNCHECK (PRODUCT LAUNCH)

VulnCheck provides a vulnerability intelligence platform that tracks vulnerability lifecycles and active exploitation, monitoring exploit code and payloads so security teams can identify, prioritize, and patch the CVEs that pose the most immediate, real-world risk.

vulncheck.com

TLDR InfoSec

SECURING DIGITAL ASSETS IN AN EVOLVING THREAT LANDSCAPE: THE FIREBLOCKS DEFENSE-IN-DEPTH APPROACH TO SECURITY

Summary unavailable

fireblocks.com · 29 min

TLDR InfoSec

HACKERS OFFER TO SELL MILLIONS OF EURAIL USER RECORDS

Hackers claim to have stolen 1.3 TB of data from Eurail's AWS S3, Zendesk, and GitLab, including source code, support tickets, and database backups with personal data on potentially millions of Eurail and Interrail customers. Exposed fields range from contact and passport details to health and bank data for DiscoverEU travelers.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

INFOSTEALER STEALS OPENCLAW AI AGENT CONFIGURATION FILES AND GATEWAY TOKENS

An infostealer, likely a Vidar variant, exfiltrated OpenClaw config files containing gateway tokens, device keys, and an AI agent “soul,” enabling remote access and identity hijacking. Meanwhile, malicious ClawHub skills, exposed OpenClaw instances with RCE potential, and persistent Moltbook accounts are growing attacker interest as OpenClaw's ecosystem rapidly scales.

thehackernews.com · 4 min

TLDR InfoSec

MICROSOFT ALERTS ON DNS-BASED CLICKFIX VARIANT DELIVERING MALWARE VIA NSLOOKUP

There is a new ClickFix variant that uses nslookup commands via the Windows Run dialog to retrieve and execute second-stage payloads through DNS, ultimately deploying the Python-based ModeloRAT remote access trojan.

securityaffairs.com · 1 min

TLDR InfoSec

CISA GIVES FEDS 3 DAYS TO PATCH ACTIVELY EXPLOITED BEYONDTRUST FLAW

CISA added BeyondTrust's actively exploited OS command-injection flaw (CVE-2026-1731) to its KEV catalog, ordering federal agencies to patch Remote Support and Privileged Remote Access instances by February 16, as approximately 8,500 on-premises deployments remain exposed.

bleepingcomputer.com · 2 min

TLDR InfoSec

SPAIN ORDERS NORDVPN AND PROTONVPN TO BLOCK LALIGA STREAM PIRACY

A Spanish court ordered NordVPN and ProtonVPN to block 16 piracy websites under the EU Digital Services Regulation, with both providers contesting the ruling as procedurally invalid since neither was notified or given the opportunity to defend themselves.

bleepingcomputer.com · 3 min