The Daily Index — Thursday, March 5, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

EXPLOITING INTEGER OVERFLOW IN THE NGINX WEB SERVER: A DEEP DIVE INTO THE VULNERABILITY

CVE-2017-7529, a now-patched integer overflow in nginx's Range header parser, affected versions 0.5.6 through 1.13.2 and allowed attackers to read out-of-bounds memory from nginx's cache files by crafting two negative byte ranges that caused a signed 64-bit integer overflow in the size accumulator, bypassing the content-length bounds check. When nginx operated as a caching proxy, the exploit leaked the raw cache file contents, including internal request headers, backend server identity, and potentially backend IP addresses. The vulnerability carried limited direct impact but demonstrated how information disclosure primitives can serve as links in a broader attack chain.

hackmag.com · 11 min

TLDR InfoSec

NEW LEXISNEXIS DATA BREACH CONFIRMED AFTER HACKERS LEAK FILES

LexisNexis confirmed that attackers accessed legacy servers, exposing customer identifiers, business contact data, survey respondents' IPs, and support tickets, while denying any impact on current products and services. Hackers claim React2Shell and misconfigured AWS led to theft of over 2 GB of data, including 400,000 personal records and sensitive enterprise, employee, and development information.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CORUNA: THE MYSTERIOUS JOURNEY OF A POWERFUL IOS EXPLOIT KIT

Coruna is a sophisticated iOS exploit kit containing five full exploit chains and 23 total exploits targeting iOS 13.0 through 17.2.1. It proliferated from a commercial surveillance vendor customer to a Russian espionage group, UNC6353, which conducted watering hole attacks against Ukrainian users, and ultimately to a Chinese financially motivated actor, UNC6691, that deployed it via fake crypto exchange sites to steal cryptocurrency wallet credentials. The kit's final payload, PLASMAGRID, hooks into 18 crypto wallet apps, scans for BIP39 seed phrases, and uses a DGA seeded with "lazarus" to generate fallback C2 domains. iPhone users should update to the latest iOS immediately. Where updates aren't possible, enabling Lockdown Mode is recommended, and defenders should review the published YARA rules and IOCs for hunting activity.

cloud.google.com · 15 min

TLDR InfoSec

DNS-PERSIST-01: A NEW MODEL FOR DNS-BASED CHALLENGE VALIDATION

DNS-01 is a standard for validating ACME certificate issuance by publishing a DNS record to verify the domain ownership. The mechanism can lead to operational complexity because it requires a new TXT record for each issuance, which may need DNS API credentials to be embedded in automation scripts. It also makes the renewal process vulnerable to DMS propagation delays. Let's Encrypt has proposed a new standard called DNS-PERSIST-01, which enables a persistent DNS record to pin an ACME request and specific CA that can issue records.

letsencrypt.org · 5 min

TLDR InfoSec

RARE NOT RANDOM: USING TOKEN EFFICIENCY FOR SECRETS SCANNING

Gitleaks has traditionally built its secrets scanner using a combination of regexes, entropy, and rule-based filters. This post details how the team adapted the scanner to use token efficiency, which tests how frequently a piece of text appears in a model's training data by dividing it into tokens, instead of entropy, to boost performance. Using this method and a few other tweaks, the author created a tool called BetterLeaks, which outperforms other scanners, such as CredSweeper, on secret detection in the CredData dataset.

lookingatcomputer.substack.com · 6 min

TLDR InfoSec

JETSTREAM SECURITY (PRODUCT LAUNCH)

JetStream provides an AI governance platform that builds dynamic “AI Blueprints” to map AI agents, models, data, tools, and identities, giving enterprises real-time visibility, risk control, and cost tracking for production AI deployments.

jetstream.security

TLDR InfoSec

AVIRA: DESERIALIZE, DELETE, AND ESCALATE - THE PROPER WAY TO USE AN AV

Quarkslab disclosed three vulnerabilities in Avira Internet Security (versions 1.1.109.1990 and below, fixed in 1.1.114.3113): CVE-2026-27748, a symlink-following arbitrary file delete in the Software Updater running as SYSTEM; CVE-2026-27749, an unfiltered .NET BinaryFormatter deserialization in System Speedup's RealTimeOptimizer that reads an attacker-controlled file from the user-writable ProgramData directory; and CVE-2026-27750, a TOCTOU folder delete in the Optimizer that enables the Config.msi junction trick for a SYSTEM shell. The file delete primitive chains into the deserialization bug when temp_rto.dat already exists and can't be overwritten, while the TOCTOU path plants HID.DLL via MSI rollback. The writeup also documents a contentious disclosure process in which Gen Digital refused to accept vulnerability reports outside its NDA-bound bug bounty platform.

blog.quarkslab.com · 13 min

TLDR InfoSec

CHINA'S SILVER DRAGON RAZES GOVERNMENTS IN EU, SE ASIA

Chinese threat actor Silver Dragon, linked to APT41, has targeted government networks in Southeast Asia and Europe since mid‑2024 using phishing and exploits against Internet‑facing servers to conduct espionage. It relies on Cobalt Strike, DNS tunneling, and other methods, so security teams should harden public‑facing services and monitor for any suspicious movements.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

CHAT AT YOUR OWN RISK! DATA BROKERS ARE SELLING DEEPLY PERSONAL BOT TRANSCRIPTS

Browser extensions posing as free VPNs or ad blockers are intercepting AI chats and feeding verbatim prompts and responses into commercial datasets, exposing names, health data, immigration issues, legal problems, and corporate secrets. Data brokers resell these searchable transcripts, undermining anonymization claims and creating major risks around re‑identification, patient privacy violations, abuse disclosures, and sensitive corporate leakage.

theregister.com · 2 min

TLDR InfoSec

TIKTOK WON'T ADD END-TO-END ENCRYPTION TO DIRECT MESSAGES, REPORT SAYS

TikTok has decided against rolling out end-to-end encryption for direct messages, arguing that it would hinder law enforcement and internal safety teams' ability to access harmful content involving users, especially minors.

techcrunch.com · 1 min

TLDR InfoSec

FAKE ZOOM, TEAMS MEETING INVITES USE COMPROMISED CERTIFICATES TO DROP MALWARE

A February 2026 phishing campaign documented by Microsoft Defender researchers uses fake Zoom, Teams, and Adobe Reader update pages signed with a stolen EV certificate from TrustConnect Software PTY LTD to deliver RMM tools and establish persistent backdoor access for credential theft and ransomware deployment.

hackread.com · 2 min

TLDR InfoSec

FAKE LASTPASS SUPPORT EMAIL THREADS TRY TO STEAL VAULT PASSWORDS

There is an active phishing campaign that uses spoofed support email threads and fake unauthorized access alerts to direct victims to a credential-harvesting page at verify-lastpass[.]com.

links.tldrnewsletter.com · 2 min