The Daily Index — Tuesday, August 11, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

SPY CAMERAS ON NAVY DRONES SECRETLY SENT DATA TO CHINA

The UK's Royal Navy spy drones were revealed to be covertly transmitting data to China. The Ministry of Defense stated that their investigation revealed that no sensitive data had been transmitted to China and that the drones were only sending heartbeat communications. The UK's Tory party is calling on the government to audit equipment for Chinese footprints.

telegraph.co.uk · 4 min

TLDR InfoSec

THIS BIZARRE EMAIL FLAW IS LEAKING CORPORATE SECRETS TO ANYONE WHO BUYS THE RIGHT DOMAIN

Security researchers discovered that seemingly harmless addresses such as noreply and deleteduser could leak sensitive corporate information via unintended emails. The researchers realized that domains such as noreply[.]net and noreply[.]us were receiving huge volumes of emails. WIRED reported that noreply[.]net received more than 400k messages over a year and a half, including more than 28k attachments.

digitaltrends.com · 2 min

TLDR InfoSec

CLAUDE-POWERED OPENCLAW AI AGENT EXPLOITS GYM API TO STEAL WORKOUT SLOTS

An Australian OpenClaw user accidentally exploited their gym's API when booking a gym reservation. The user's Claude-powered OpenClaw first discovered a vulnerability that allowed it to book reservations beyond the allowed period, but then when the user asked OpenClaw to try and move their reservation from fourth on the list to the top, it discovered that the API allowed for canceling arbitrary users' appointments and, unprompted, canceled the first appointment. The user contacted the gym via OpenClaw to disclose the vulnerability.

cybersecuritynews.com · 2 min

TLDR InfoSec

I FOUND A VM ESCAPE BUG IN KVM AND SOMEONE ELSE GOT THERE FIRST

A malicious VM could trigger a repeatable heap out-of-bounds read/write escape in KVM's SEV-SNP Page State Change handler due to a bounds check that validated against a protocol constant rather than the actual, guest-controlled scratch buffer size. This flaw yielded five powerful primitives, including a failure oracle, a GFN leak, and guest-controlled slab selection. Tracked as CVE-2026-53360, the vulnerability affects kernels since v6.10 and was ultimately mitigated in versions v7.0.12, v6.18.35, and v6.12.93 by rejecting external scratch allocations entirely and adding READ_ONCE() to close a TOCTOU window, underscoring the need to validate against actual allocation sizes rather than protocol maximums.

blog.himanshuanand.com · 23 min

TLDR InfoSec

8 OUT OF 10 BANKS IN BELGIUM HATE THIS ONE WEIRD EID RCE

Researchers discovered critical vulnerabilities in Connective's eID signing extension, used by most Belgian banks and government agencies, that allowed malicious sites to silently extract smart card data and recover eID PINs due to missing origin binding. Furthermore, the extension's GET_READERS command permitted arbitrary relative DLL loading, enabling drive-by remote code execution if a victim simply downloaded a disguised PDF/DLL polyglot. Nitro fully mitigated these flaws by July 22. Defenders should verify all deployed Connective clients are updated past this date to enforce origin checks and block vulnerable library commands.

amibeingpwned.com · 14 min

TLDR InfoSec

See just-in-time access in action

Summary unavailable

1password.com

TLDR InfoSec

OPENAI LAUNCHES GPT-5.6-CYBER WITH FEWER REFUSALS FOR EXPLOIT RESEARCH

OpenAI launched Daybreak Red and Blue to provide access to GPT-5.6 Sol with fewer guardrails for offensive and defensive security practitioners respectively. Daybreak Blue is meant for most security practitioners and has guardrails calibrated for vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. Daybreak Red goes further by providing access to GPT-5.6-Cyber, which was trained to reduce refusals for authorized vulnerability research, exploit-chain development, and other high-risk security tasks.

runtimewire.com · 2 min

TLDR InfoSec

FROM FINDING TO FIXING: REDUCING MAINTAINER BURDEN WITH AUTOMATED PATCHES

Google now pairs OSS-Fuzz with CodeMender, DeepMind's AI code security agent, so the pipeline moves beyond reporting crashes to performing root-cause analysis and generating validated patches for C/C++ memory safety bugs. Each patch is tested in isolation to confirm it compiles, fixes the crash, and avoids regressions, with Google engineers manually reviewing submissions during this beta phase, and projects that restrict AI-generated code are automatically excluded. Enrolled OSS-Fuzz projects receive these patches by default and can opt out through their existing configuration.

blog.google · 3 min

TLDR InfoSec

BEYOND PROMPT INJECTION: HACKING APPLE'S PRIVATE CLOUD COMPUTE

Researcher Drinor Selmanaj discovered a path traversal vulnerability (CVE-2026-20685) in darwin-init that allowed attackers to write persistent files to the writable data volume on Apple's Private Cloud Compute nodes. By hijacking the splunkloggingd process, the exploit successfully redirected node telemetry to an attacker-controlled server, exposing sensitive job metadata and inference token counts. Apple's attestation chain only measures installed software and ignores writable-volume states, so this persistent tampering went entirely undetected, ultimately earning the researcher a $150,000 bounty and prompting a patch in PCC release 5E290.3.

blog.sentry.security · 10 min

TLDR InfoSec

TURKEY'S CYBER LAW SHIFTS SWEEPING POWERS TO THE PRESIDENCY

Turkey has enacted new legislation that centralizes digital oversight under the Cybersecurity Directorate. The government argues that this is necessary for national security reasons. However, critics worry about this new legislation being abused by the government for censorship.

tradersunion.com · 2 min

TLDR InfoSec

SERVING THE MOST CRITICAL MISSIONS: CLOUDFLARE FOR GOVERNMENT ACHIEVES FEDRAMP CLASS D (HIGH) CERTIFIED STATUS

Cloudflare for Government achieved FedRAMP Class D (High) certification, sponsored by NIST, clearing the standard for the nation's most sensitive unclassified data covering law enforcement, emergency services, financial systems, and national security. The company built its High offering on the same global network and software stack running its commercial platform rather than an isolated environment, using its Data Localization Suite to confine FedRAMP High traffic processing to US data centers. Cloudflare is now pursuing DoD Impact Level 4 authorization on the same underlying systems.

blog.cloudflare.com · 4 min

TLDR InfoSec

THIS IRANIAN MALWARE HAS NO C2 SERVER TO BLOCK. THE COMMAND CHANNEL IS A MEETING INVITE IN YOUR OWN CALENDAR

HollowGraph is an Iranian-nexus malware tied to the Cavern backdoor framework that runs no command-and-control infrastructure at all and instead reads orders from and writes stolen data into a victim's own Microsoft 365 calendar over the legitimate Graph API. The implant encrypted its traffic with a hybrid RSA plus AES-256-GCM scheme using separate key pairs per direction and exfiltrated Entra ID credentials via DNS tunneling. Group-IB counted twelve infected Israeli systems active between June 3 and July 9. It linked the malware to the Lyceum espionage cluster, and Check Point separately documented the same Cavern framework this month under the name Cavern Manticore.

dugganusa.com · 5 min

TLDR InfoSec

ONE-CLICK FLAW IN ATLASSIAN ROVO EXPOSED ENTERPRISE DATA VIA PROMPT INJECTION ATTACK

Atlassian has patched "RovoBlast," a single-click prompt injection vulnerability in Rovo's rovoChatPrompt parameter discovered by Varonis that allowed attackers to hijack the AI's autonomous agents and silently exfiltrate enterprise data across more than 50 connected platforms without requiring credential compromise.

csoonline.com · 3 min

TLDR InfoSec

US, SOUTH KOREAN GOVERNMENT AGENCIES CAUTION TO BE ON LOOKOUT FOR GUNRA RANSOMWARE GANG

CISA, the FBI, NSA, Secret Service, and South Korea's National Police Agency warned that the Gunra ransomware-as-a-service gang has hit government and critical infrastructure targets across five continents.

cyberscoop.com · 2 min

TLDR InfoSec

UK MAN TIED TO THE COM SENTENCED FOR ABUSING 117 VICTIMS

A 20-year-old UK man was sentenced to two years and ordered to register as a sex offender after admitting to child sexual abuse and blackmail offenses tied to The Com, a sprawling online network of minors and young adults.

cyberscoop.com · 2 min