The Daily Index — Monday, March 9, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

CYBERSTRIKEAI TOOL ADAPTED BY ATTACKERS FOR AI-POWERED ATTACKS

Security researchers are warning that attackers are using AI-powered tools to hunt for and exploit vulnerable Fortinet FortiGate firewalls. The researchers note that the attackers are using the security orchestration tool CyberStrikeAI, which features a full security platform with over 100 tools that AI agents can use for hunting. The developer behind the tool is believed to have ties to China and possibly other Chinese security organizations.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

A RACE WITHIN A RACE: EXPLOITING CVE-2025-38617 IN LINUX PACKET SOCKETS

CVE-2025-38617 is a 20-year-old use-after-free in the Linux kernel's AF_PACKET subsystem (net/packet/af_packet.c), present since Linux 2.6.12 and fixed in 6.16, exploitable by any unprivileged user with CAP_NET_RAW (obtainable via user namespaces) to achieve full privilege escalation and container escape. The root cause is a conditional WRITE_ONCE(po->num, 0) that only zeroes the protocol number when the socket was already running, leaving a window where a NETDEV_UP event can re-register the protocol hook while packet_set_ring() is mid-free. The exploit stretches this nanosecond race to a deterministic one-second window by pre-acquiring pg_vec_lock via a sleeping tpacket_snd() call, then uses a BPF filter delay and a 720,000-entry timerfd wait queue interrupt to win the second race. The resulting five-stage exploit chains a page overflow into simple_xattr corruption, heap read/write via pgv array overlap, arbitrary page read/write through a master-puppet ring buffer pair, KASLR bypass via anon_pipe_buf_ops pointer recovery, and final privilege escalation via syscall patching, defeating both CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL mitigations.

blog.calif.io · 21 min

TLDR InfoSec

MALICIOUS PACKAGIST PACKAGES DISGUISED AS LARAVEL UTILITIES DEPLOY ENCRYPTED RAT

Three Packagist packages published by the threat actor nhattuanbl deliver a fully functional PHP RAT via src/helper.php, encrypted with AES-128-CTR and sent to a C2 at helper[.]leuleu[.]net:2096, with commands supporting remote shell execution, file upload/download, and screen capture across Windows, macOS, and Linux. A third package, lara-swagger, carries no malicious code itself but pulls in the RAT as a hard Composer dependency pinned to dev-master, allowing the operator to update the payload at any time without modifying the clean-looking package. Laravel teams should audit transitive Composer dependencies, treat dev-master constraints as high-risk in production, rotate all secrets accessible from affected application environments, and block outbound traffic to the C2 host.

socket.dev · 9 min

TLDR InfoSec

HOW TO AVOID CONFIDENTIALITY GAPS IN EARLY-STAGE STARTUPS

Early-stage startups routinely expose proprietary information during funding, hiring, and partnership discussions by delaying legal protections until sensitive details have already been shared, a pattern that contributes to the 61% breach rate cited in the 2025 Panaseer Security Leaders Report. Startups should deploy NDAs and confidentiality agreements selectively but proactively: before contractor access to code or design assets, during deep technical diligence with non-standard investors, and via a two-deck pitch strategy that gates the confidential technical appendix behind a signed NDA. Lightweight tooling with e-signature audit trails, a single document owner, and quarterly reviews is sufficient for pre-seed teams. Complexity should scale with contract volume, not be front-loaded.

hackread.com · 5 min

TLDR InfoSec

CARELESSNESS VS CRAFTSMANSHIP IN CRYPTOGRAPHY

Trail of Bits researchers discovered that the widely used pyaes and aes-js packages used default IVs in their documentation, which can lead to vulnerable applications. The team contacted both projects and received no response, but found that the maintainers behind pyaes had dismissed a ticket raised about the vulnerability in 2022. The team contrasted this with StrongMan VPN's response to the team contacting them about their use of the vulnerable pyaes library. The maintainer fully replaced the library and migrated to the more secure GCM-SIV mode of AES.

blog.trailofbits.com · 6 min

TLDR InfoSec

EVERVAULT (PRODUCT LAUNCH)

Evervault provides a developer-first platform to encrypt and orchestrate sensitive data - especially payment card data - so companies can process, share, and route it end-to-end without handling it in plaintext, simplifying PCI compliance and reducing breach risk.

evervault.com

TLDR InfoSec

SEEDWORM: IRANIAN APT ON NETWORKS OF US BANK, AIRPORT, SOFTWARE COMPANY

Symantec's Threat Hunter Team has detected Seedworm (MuddyWater) activity on networks of a US bank, airport, defense-adjacent software company, and NGOs in the US and Canada since February, deploying two newly identified backdoors: Dindoor, a Deno-based JavaScript/TypeScript backdoor, and Fakeset, a Python backdoor, both signed with certificates previously linked to the group. The intrusions follow US and Israeli military strikes on Iran and coincide with escalating activity from aligned hacktivist groups, including Handala and DieNet, raising the threat of destructive wiper attacks, DDoS campaigns, and hack-and-leak operations against critical infrastructure. Defenders should prioritize MFA enforcement, Rclone/cloud-exfiltration monitoring, DDoS protection for public-facing services, and immutable offline backups, given Iran's demonstrated history of deploying destructive payloads, such as Shamoon, during geopolitical escalation windows.

security.com · 12 min

TLDR InfoSec

HARDENING FIREFOX WITH ANTHROPIC'S RED TEAM

Anthropic's Frontier Red Team applied AI-assisted vulnerability detection to the Firefox codebase, surfacing 14 high-severity bugs and 22 CVEs, plus 90 additional lower-severity issues, all shipped with reproducible test cases that allowed Mozilla engineers to validate and patch the findings within hours ahead of Firefox 148. Notably, the model identified distinct classes of logic errors that decades of fuzzing and static analysis had not previously uncovered, suggesting a significant backlog of latent bugs across mature, well-audited codebases. As a result, Mozilla has begun integrating AI-assisted analysis into its internal security workflows.

blog.mozilla.org · 3 min

TLDR InfoSec

OPENAI CODEX SECURITY SCANNED 1.2 MILLION COMMITS AND FOUND 10,561 HIGH-SEVERITY ISSUES

OpenAI's Codex Security is an AI agent that creates project context, threat models, and verifies vulnerabilities to reduce false positives while suggesting ready-to-review fixes. In beta, it analyzed 1.2 million commits, identifying thousands of critical and high‑severity issues across major open‑source projects.

thehackernews.com · 3 min

TLDR InfoSec

TRANSPORT FOR LONDON SAYS 2024 BREACH AFFECTED 7M CUSTOMERS, NOT 5,000

TfL has disclosed that attackers accessed systems containing data on over 7 million customers, far beyond the 5,000 high‑risk users first flagged with exposed bank details.

theregister.com · 2 min

TLDR InfoSec

FBI INVESTIGATING HACK ON ITS WIRETAP AND SURVEILLANCE SYSTEMS: REPORT

Hackers breached an FBI network used to manage wiretaps and foreign intelligence surveillance warrants, prompting an internal investigation and technical incident response by the bureau.

techcrunch.com · 1 min

TLDR InfoSec

MISSISSIPPI MEDICAL CENTER REOPENS CLINICS HIT BY RANSOMWARE ATTACK

The University of Mississippi Medical Center resumed normal operations nine days after a ransomware attack blocked access to electronic medical records and forced the cancellation of outpatient procedures, ambulatory surgeries, and imaging appointments across its seven hospitals and 35 clinics.

links.tldrnewsletter.com · 2 min