The Daily Index — Thursday, July 30, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CRITICAL OPENWRT DHCPV6 FLAW COULD LET UNAUTHENTICATED ATTACKERS RUN CODE AS ROOT

An unauthenticated attacker able to reach odhcpd's DHCPv6 listener on UDP port 547 could overwrite a fixed 512-byte stack buffer through crafted IA options in a DHCPv6 REQUEST, tracked as CVE-2026-53921 with a CVSS of 9.8, and since odhcpd runs as root and embedded devices commonly lack stack canaries and ASLR, code execution is a realistic outcome rather than just a crash. The same 24.10.8 and 25.12.5 releases also close several other pre-authentication odhcpd bugs (out-of-bounds write, use-after-free, memory disclosure, neighbour-discovery proxy spoofing), three uhttpd request-smuggling flaws, and a DHCPv6 hostname-injection issue (CVE-2026-62948) that produces stored XSS in LuCI. Administrators should update the 24.10 branch to 24.10.8 or the 25.12 branch to 25.12.5 via the OpenWrt Firmware Selector, patch any separately installed packages, and note that a related batch of LuCI command-injection and path-traversal fixes from a separate Hacker House audit remains open and unmerged as of July 28.

thehackernews.com · 6 min

TLDR InfoSec

AI-ASSISTED BUG HUNT UNCOVERS LINUX KERNEL 0-DAY IN NET/SCHED

Researcher Lee Jia Jie of STAR Labs used AI to uncover and reliably trigger a use-after-free race condition in the Linux kernel's net/sched subsystem, tracked as CVE-2026-53264, where mismatched RCU locking let a shared object be freed and reused while still referenced, enabling local privilege escalation to root on systems with unprivileged user namespaces enabled. The flaw had persisted for two to three years and was independently found by an AI system named KyleBot before Jia Jie's TyphoonPwn 2026 submission, and he separately reported two exploitable perf events subsystem bugs, including CVE-2026-64300, affecting Intel bare-metal RHEL-based and Arch systems under permissive performance-monitoring settings. CVE-2026-53264 has been patched upstream by deferring object deallocation until after the RCU grace period, so administrators should pull updated kernels through their distribution's security channels and review user namespace exposure on affected desktop systems.

infosecurity-magazine.com · 3 min

TLDR InfoSec

CISCO WARNS OF FMC STATIC CREDENTIAL FLAW EXPLOITED IN ZERO-DAY ATTACKS

Cisco is warning customers of a vulnerability in its Secure Firewall Management Center (FMC) systems. The vulnerability is due to a low-privilege account that is enabled by default and uses static credentials to authenticate. While the CVE was only given a CVSS score of 5.3, Cisco rates it as a high-severity vulnerability due to other vulnerabilities that an attacker could chain to escalate privileges.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

PHISHING DOMINATES AS INITIAL ENTRY METHOD FOR CYBER-ATTACKS, AS HACKERS HONE EVASION TECHNIQUES

Cisco Talos's Incident Response Trends report for Q2 2026 found phishing accounted for just over half of investigated initial access incidents, up from a third the prior quarter, with threat actor UAT-11764 running a persistent campaign that uses victim-tailored PDFs containing QR codes to evade email gateway scanning and direct targets to credential harvesting pages hosted on trusted platforms like Microsoft 365 and SharePoint. Once compromised, accounts were used to create defense-evading inbox rules and propagate further phishing, while separately observed phishing-as-a-service kits now offer OAuth device-flow MFA bypass, Primary Refresh Token persistence, and encrypted anti-analysis payloads. Defenders are advised to enforce phishing-resistant MFA, block or flag QR codes in PDF attachments, monitor for suspicious inbox rule creation and SharePoint file staging, and tighten outbound email thresholds to limit lateral propagation.

infosecurity-magazine.com · 3 min

TLDR InfoSec

DETECTION ENGINEERING IN THE ERA OF SEMANTIC MALWARE

Malware campaigns that target agents via their memory or other configuration present detection engineering challenges as they don't produce classical indicators of compromise. Some classic detection techniques such as File Integrity Monitoring (FIM), privilege auditing, and behavioral baselining can be adapted to agentic threats. Additionally, the agentic landscape also offers some new detection opportunities such as: context window integrity, agent session telemetry, memory file provenance, and cross-session behavioral correlation.

detect.fyi · 14 min

TLDR InfoSec

TENGU BOTNET REBOOTS COMPROMISED LINUX DEVICES WHEN DEFENDERS KILL ITS PROCESS

Nozomi Networks Labs identified a Mirai-derived botnet named Tengu that abuses a compromised Linux device's hardware watchdog to force a reboot whenever its main process is killed, giving its other persistence mechanisms, including a fake systemd service and immutable binaries, another chance to relaunch. The researchers stopped short of establishing the botnet's real-world scale, and independent URLhaus telemetry at the same C2 address confirmed only generic Mirai-related hosting rather than Tengu itself.

thehackernews.com · 4 min

TLDR InfoSec

THE ARGUMENTS AGAINST OPEN SOURCE AI ARE VERY BAD

In the wake of powerful Chinese models such as GLM 5.2 and Kimi K3, US frontier model labs have been pushing against open-source models. Common arguments include: China is building high-quality, free models now with the goal of eliminating competition, models may spread propaganda, and models may contain backdoors. Not only are these arguments weak, but they are also irrelevant, as suppressing open-source software has always been a losing battle.

tombedor.dev · 8 min

TLDR InfoSec

COMPARING OPEN-SOURCE AI CODE SECURITY HARNESSES

This post distinguishes between several approaches: LLM-led exploit generation, where large language models operate independently to find vulnerabilities; LLM skill-boosting vulnerability research, which involves providing skills to an LLM to emulate a human vulnerability researcher's reasoning; and hybrid tools combining SAST with LLMs. LLM-led exploit generation can be seen as a new type of fuzzing but is challenging because it requires access to model providers with fewer guardrails. The post outlines various use cases for different skills and the integration of SAST with LLMs.

semgrep.dev · 4 min

TLDR InfoSec

HOW 0X SECURES $200B WITH HARMONY'S AI APPSEC AGENTS

0x, the DeFi infrastructure layer underpinning Coinbase, Robinhood, MetaMask, and Phantom wallets, expanded its use of Harmony Intelligence's AI-driven security testing across its full product suite after an initial review convinced its engineering team the tool surfaced vulnerabilities with clearer prioritization than traditional pentests.

harmonyintelligence.com · 3 min

TLDR InfoSec

NVIDIA BLUEFIELD FLAW LETS VM USERS EXECUTE CODE VIA CRAFTED MESSAGES

NVIDIA patched CVE-2026-65094, a CVSS 9.0 Write-What-Where flaw in VIRTIO-Net on BlueField-3 DPUs that let adjacent VM users execute arbitrary code and break tenant isolation.

gbhackers.com · 1 min