The Daily Index — Friday, February 27, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

CISCO SAYS HACKERS HAVE BEEN EXPLOITING A CRITICAL BUG TO BREAK INTO BIG CUSTOMER NETWORKS SINCE 2023

Hackers have abused a max‑severity 10.0 flaw in Cisco Catalyst SD‑WAN gear since at least 2023 to gain top‑level access, maintain stealthy persistence, and spy on or steal data from large enterprises and critical infrastructure worldwide. Governments, including the US, UK, Canada, Australia, and New Zealand, warn of global targeting.

techcrunch.com · 2 min

TLDR InfoSec

ABUSING CORTEX XDR LIVE TERMINAL AS A C2 - INFOGUARD LABS

InfoGuard researchers demonstrated that Palo Alto's Cortex XDR Live Terminal feature can be abused as a pre-installed, EDR-trusted C2 channel, offering command execution, file transfer, and evasion capabilities through traffic that blends natively into enterprise network flows. The attack exploits a trivial URL validation flaw in cortex-xdr-payload.exe and the absence of mutual authentication or cryptographic command signing, allowing attackers to redirect connections to their own infrastructure via cross-tenant hijacking or a custom WebSocket server. Defenders should monitor for cortex-xdr-payload.exe spawned by any parent process other than cyserver.exe, while Palo Alto's claimed fix in versions 8.7-8.9 was not confirmed effective as of February.

labs.infoguard.ch · 7 min

TLDR InfoSec

NEW AIRSNITCH ATTACK BREAKS WI-FI ENCRYPTION IN HOMES, OFFICES, AND ENTERPRISES

AirSnitch exploits low-level Wi-Fi behavior to bypass client isolation, enabling bidirectional MitM from any SSID on the same AP against popular consumer and enterprise gear. Attackers can steal cookies, credentials, and RADIUS secrets, pivot between guest and corporate networks, and poison DNS, challenging assumptions about guest Wi-Fi safety and pushing networks toward stricter zero‑trust segmentation and careful AP/VLAN design.

arstechnica.com · 9 min

TLDR InfoSec

THE POST-RAMP ERA: ALLEGATIONS, FRAGMENTATION, AND THE REBUILDING OF THE RANSOMWARE UNDERGROUND

In January 2026, the FBI-led seizure of the RAMP forum dismantled a central hub for ransomware coordination but mainly shattered trust and pushed actors into more fragmented spaces, such as the closed, pay-to-enter T1erOne and the open forum Rehub. Competing narratives about leaked RAMP data and possible insider abuse have reinforced fears of honeypots, driving a shift toward smaller, tightly vetted communities and parallel use of low-barrier platforms.

rapid7.com · 9 min

TLDR InfoSec

GAMBIT SECURITY (PRODUCT LAUNCH)

Gambit Security's AI-powered resilience platform, Balens, maps environments, security products, and backups to uncover gaps, validate recovery paths in real-time, and ensure business continuity against ransomware and disruptions.

gambit.security

TLDR InfoSec

NEVER BUY A .ONLINE DOMAIN

A developer's .online domain was suspended via serverHold by registry operator Radix after Google Safe Browsing flagged the site, with no prior notification or grace period. The suspension created a Catch-22 where Google required DNS-based domain verification to review the flag, but the registry refused to reactivate DNS until Google removed it. The incident highlights the risks of non-.com TLDs with aggressive abuse policies and reinforces the importance of pre-registering domains in Google Search Console and adding uptime monitoring even for simple landing pages.

0xsid.com · 4 min

TLDR InfoSec

GOOGLE CATCHES BEIJING SPIES USING SHEETS TO SPREAD ESPIONAGE ACROSS 4 CONTINENTS

Google Threat Intelligence disrupted UNC2814, a China-linked espionage group that compromised 53 victims across 42 countries by targeting telecoms and government organizations with a novel backdoor called Gridtide that abuses Google Sheets API for C2 communication. The group, tracked since 2017, escalated privileges via SSH lateral movement and deployed SoftEther VPN Bridge for persistent encrypted connections, with infrastructure dating back to July 2018. Google terminated all attacker-controlled Cloud Projects, disabled known infrastructure, and revoked the Sheets API access used for C2 operations.

theregister.com · 3 min

TLDR InfoSec

THE BLAST RADIUS PROBLEM: STOLEN CREDENTIALS ARE WEAPONIZING AGENTIC AI

IBM X-Force data shows high volumes of unauthenticated vulnerabilities and a surge in infostealer‑driven credential theft, including hundreds of thousands of stolen ChatGPT logins. Attackers use AI and agentic systems to expand blast radius, pivot through supply chains, and blur criminal and nation‑state tradecraft.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

with less open tabs. Simplify with Azure

Summary unavailable

links.tldrnewsletter.com

TLDR InfoSec

TREASURY SANCTIONS EXPLOIT BROKER NETWORK FOR THEFT AND SALE OF US GOVERNMENT CYBER TOOLS

The US Treasury sanctioned Russian exploit broker Operation Zero and its founder Sergey Zelenyuk for acquiring at least eight stolen US government cyber tools from an insider and selling them to unauthorized buyers, marking the first-ever action under the Protecting American Intellectual Property Act.

home.treasury.gov · 4 min

TLDR InfoSec

LINUX EXPLORES NEW WAY OF AUTHENTICATING DEVELOPERS AND CODE - HERE'S HOW IT WORKS

Linux kernel maintainers have proposed replacing the aging PGP web of trust with a decentralized identity layer built on W3C DIDs and verifiable credentials.

zdnet.com · 5 min

TLDR InfoSec

CLAUDE'S COWORK DESKTOP APP NOW RUNS SCHEDULED TASKS SO YOUR AI ASSISTANT WORKS WHILE YOU SLEEP

Anthropic's Cowork desktop app has added scheduled task automation for Claude, enabling recurring workflows like morning briefings and weekly report generation, though security professionals should carefully scope the system access granted to the agent.

the-decoder.com · 1 min