The Daily Index — Wednesday, August 12, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

LOCKING YOUR SSH-AGENT EXPOSED LOCAL-ONLY KEYS UNTIL OPENSSH 10.5

OpenSSH 10.5 fixed a flaw introduced in version 10.4 where locking the ssh-agent disabled the check distinguishing local requests from forwarded ones, letting remote connections perform operations meant to stay local, including adding PKCS#11 tokens and bypassing destination-restricted keys, alongside a use-after-free in the ssh client and a broken authorized_keys "restrict" keyword that failed to block tunnel forwarding.

helpnetsecurity.com · 3 min

TLDR InfoSec

PROJECT CAV3RN CONTINUES: GOOGLE APPS SCRIPT AS C2 RELAY AND DNS-BASED C2 CHANNEL SELECTION

Kaspersky researchers uncovered an updated Project CAV3RN espionage framework targeting Israeli organizations that dynamically routes command-and-control traffic by inspecting DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay. This evasive technique allows the malware to blend seamlessly with legitimate traffic before handing execution to an inter-component broker (⁠rnp.dll⁠) that orchestrates malicious modules. To detect this activity, defenders should flag anomalous ⁠script.google[.]com⁠ POST requests and hunt for associated infrastructure, specifically queries resolving to ⁠studiotikva[.]com⁠.

securelist.com · 7 min

TLDR InfoSec

THE PERMANENT THREAT: ANALYZING AETERNUM'S BLOCKCHAIN-BASED C2 OPERATIONS AND COMPROMISES

Aeternum is a sophisticated malware loader that utilizes Polygon blockchain smart contracts over JSON-RPC to fetch encrypted command-and-control instructions. After decrypting these commands, the malware downloads secondary payloads from GitHub, including the XWorm RAT and XMRig miners, while a related Python variant specifically targets over 60 cryptocurrency wallets and browser extensions. Aeternum ultimately relies on hardcoded Telegram bot APIs for data exfiltration. Defenders should hunt for anomalous Telegram API traffic and outbound JSON-RPC calls originating from non-browser processes.

unit42.paloaltonetworks.com · 20 min

TLDR InfoSec

attack surface. Get your copy.

Summary unavailable

horizon3.ai

TLDR InfoSec

WE'RE OPEN-SOURCING OUR PRIVACY PROXY CLI

Cloudflare has open-sourced pvcli, a Rust-based diagnostic tool that handles full Oblivious HTTP (OHTTP) requests across relays, gateways, and targets in a single command to eliminate tedious manual binary parsing. Unlike single-protocol alternatives, the utility combines OHTTP, CONNECT proxying, and MASQUE support using a familiar curl-like syntax. This unified approach significantly accelerates incident response and debugging for engineers managing large-scale privacy deployments like Apple's Private Relay and Microsoft's Edge Secure Network VPN.

blog.cloudflare.com · 8 min

TLDR InfoSec

BEELZEBUB (PRODUCT LAUNCH)

Beelzebub provides a platform that traps attackers already inside a network, using LLM-based decoys, continuous emulation, and an AI analyst to generate incident reports. It runs on-premises or as SaaS and pulls threat feeds from 60+ researchers.

beelzebub.ai

TLDR InfoSec

EXTENSION BANNED FOR STEALING AI CHATS RETURNS TO CHROME STORE, RESUMES MALICIOUS ACTIVITIES

Google pulled "AI Sidebar with DeepSeek, ChatGPT, Claude and more" in January after OX Security found it scraping ChatGPT/DeepSeek chats and sending them to external domains, with 300,000+ installs by then. It's back on the Chrome Web Store. Netskope found version 1.7.3.0 added 21 lines that open affiliate links on update events and hijack the uninstall URL for referral commissions.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

NEW PASS-TA-KEY ATTACK REVEALS ALL THE THINGS WE DIDN'T KNOW ABOUT PASSKEYS

Pass-ta-key malware can steal passkeys from an infected Windows PC using Google Password Manager. It may pose as an iPhone, then use Google's device-sync feature to copy the victim's saved passkeys. Windows lets malware access other apps' data more easily than Apple and Android systems. A malware-infected, signed-in PC can also expose passwords and active sessions.

arstechnica.com · 3 min

TLDR InfoSec

THE MULTI-LAYERED DEFENSES THAT HARDEN CHROME AGAINST ABUSIVE NOTIFICATIONS

Chrome Security detailed a new defense-in-depth stack utilizing Firebase Cloud Messaging and Safe Browsing that successfully blocked over 7 billion abusive Android notifications per day in Q1. The multi-layered approach curtails coordinated spam networks by automatically revoking permissions for suspicious sites, analyzing malicious service worker activity signals, and throttling disruptive domains at the FCM server level to 1,000 messages per minute with HTTP 429 error responses.

blog.google · 4 min

TLDR InfoSec

PORTUGUESE HACKER TO FACE TRIAL FOR MALICIOUS CHATGPT CLONE

The 23-year-old Portuguese hacker who created WormGPT is currently on trial for creating the software.

jorgebranco.substack.com · 1 min

TLDR InfoSec

ZOOM PATCHES "ZOOMSDAY" ZERO-CLICK FLAW ENABLING REMOTE CODE EXECUTION

Zoom has released critical updates to mitigate "Zoomsday" (CVE-2026-53413), a zero-click remote code execution vulnerability in its annotation protocol that allows any meeting participant to silently trigger a stack buffer overflow and execute arbitrary code across all unpatched platforms.

securityaffairs.com · 3 min

TLDR InfoSec

NORTH KOREAN REMOTE IT STAFFER WORKED FOR US GOVERNMENT AGENCY, SAYS FBI

The FBI is investigating a sanctioned North Korean operative who fraudulently secured a remote IT position at an undisclosed US federal agency.

techcrunch.com · 2 min