The Daily Index — Wednesday, July 29, 2026 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

See how 1Password Privileged Access eliminates standing access.

Summary unavailable

1password.com

TLDR InfoSec

CUSTOMER DATA FROM INDIA'S BANK OF BARODA LEAKED ONLINE

India's state-run Bank of Baroda disclosed that customer data was stolen via a breach of an employee's email. The bank has stated that no core banking systems were accessed. The breached data includes customer details, ID numbers, loan papers, and internal audit data.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

AUSTRALIA'S ORIGIN ENERGY FLAGS POSSIBLE DATA EXPOSURE OF ABOUT 900K CUSTOMERS

Australia's top electricity and gas supplier, Origin Energy, disclosed that data linked to about 900k current and former customers had been accessed in a cybersecurity incident. Origin didn't disclose the precise data accessed but stated that it could include financial data such as the last few digits of customers' credit card numbers or bank account numbers.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HOW WE HACKED THOUSANDS OF DATA CENTERS IN MINUTES USING A 20-YEAR-OLD VULNERABILITY

Lava researchers scanned UDP port 623 and found 36,872 internet-exposed IPMI hosts, of which 24,650 returned a password-derived HMAC-SHA1 hash during the RAKP authentication exchange before login completed due to CVE-2013-4786, letting an unauthenticated party crack passwords offline. More than half of responding devices were Supermicro systems whose post-2019 unique ten-character factory passwords (a 26^10 keyspace) could still be exhausted in about an hour on an eight-GPU rig, while HPE iLO's eight-character factory format cracked in roughly 32 seconds per captured response. The team also found a live iLO 4 interface defaced with a ransom note demanding 0.3 BTC, evidence that this exposure is already being exploited rather than theoretical, and disclosed the Supermicro password-recovery timeline to the vendor in June, who confirmed it as plausible and is reviewing longer default password formats. Operators should block UDP port 623 at the network edge, rotate factory-issued BMC credentials during provisioning, disable IPMI 1.5, cipher suite 0, and NONE authentication, and isolate BMC access behind a dedicated management VLAN, bastion host, or VPN rather than exposing IPMI or Redfish directly to the internet.

lavahq.io · 10 min

TLDR InfoSec

infrastructure organizations already trust. ThreatDown

researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [12] report.

threatdown.com

TLDR InfoSec

PRIVACY-FOCUSED SEARCH ENGINE NEOSEARCH OPEN-SOURCES CODE TO PROMOTE DECENTRALIZED WEB SEARCH

NeoSearch has open-sourced its codebase under the Apache License 2.0, letting anyone inspect, modify, or self-host the ad-free, no-tracking search engine, which uses AI to downrank SEO-driven and affiliate content in favor of independent and authoritative sources while grouping and rewriting result snippets through its Lenses interface.

cyberinsider.com · 2 min

TLDR InfoSec

OPENAI'S AGENT DIDN'T GO ROGUE. ITS GOVERNANCE DID

The recent incident where an unreleased and unguardrailed OpenAI model autonomously hacked Hugging Face is commonly portrayed as an incident of a model going rogue. This is the wrong framing. The agent stayed aligned with its objective of finding a solution to the ExploitGym benchmark but wasn't given the guardrails or governance to understand that trying to steal the solution wasn't an acceptable attack path. The situation is also complicated by the fact that frontier labs are not incentivized to reduce their models' capabilities in tests and the fact that this incident was almost an advertisement for OpenAI.

bindinghook.com · 6 min

TLDR InfoSec

SOME PEOPLE'S CHATS WITH CLAUDE AI FOUND TO BE PUBLICLY AVAILABLE ONLINE

Users of claude.ai recently discovered that shared chats were indexed by search engines and could be viewed in search results. Anthropic has responded that these chats were shared publicly by users via the option to make them available to anyone with the link. Despite this, some users were surprised to find that they were indexed by search engines.

bbc.com · 2 min

TLDR InfoSec

THE CIPHER BEHIND QSYRUPWD: RECONSTRUCTING IBM I PASSWORD HASHES

Silent Signal reverse-engineered IBM i's QSYRUPWD API by tracing SCV 10 CIPHER calls through disassembly and live memory patching, mapping how the system chains SHA-1, MD5, AES-128, and Rijndael-256 operations to protect password verifiers once QPWDLVL moves past the legacy DES/SHA-1 modes. The team reconstructed the full decryption chain and confirmed it recovers crackable DES, SHA-1, and NT hash material even at QPWDLVL 4, despite the API requiring *ALLOBJ and *SECADM authority to call.

blog.silentsignal.eu · 22 min

TLDR InfoSec

CLAUDE AI JUST CRACKED A POST-QUANTUM TEST SCHEME AND FOUND A FASTER 7-ROUND AES ATTACK

Anthropic said its Claude Mythos Preview model found a new lattice symmetry to fully recover HAWK-256 signature keys and cut the cost of a seven-round AES-128 meet-in-the-middle attack by 200 to 800 times, though both results stay far from threatening production HAWK-512/1024 or full ten-round AES-128.

thehackernews.com · 6 min

TLDR InfoSec

DEF CON BANS META-STYLE 'PERVERT GLASSES'

DEF CON has banned Meta-style camera-equipped smart glasses ahead of its 2026 Las Vegas event, joining Monopoly Events and Scottish ferry operator CalMac in restricting discreet recording devices due to increasing privacy and consent concerns.

theregister.com · 3 min