The Daily Index — Wednesday, August 19, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FRENCH TAX AUTHORITY ADMITS DATA HEIST AFTER CROOK TOUTS 2M RECORDS

France's tax authority (DGFiP) confirmed that a threat actor accessed their systems in June. A forum user, ZeroBytes, claimed stolen credentials and an MFA bypass exposed data on more than two million taxpayers. DGFiP says the access was cut off during a June audit and rejects claims of ongoing access. It is identifying affected people, will notify France's data protection watchdog, and plans user notifications.

theregister.com · 2 min

TLDR InfoSec

THOUSANDS OF HACKED WORDPRESS SITES, ONE OPERATION: UNMASKING STOPANDPROTECT

A massive malware operation leveraging 2,000 compromised WordPress sites is tricking visitors with fake Cloudflare CAPTCHAs to execute malicious PowerShell commands. Researchers attributed the sprawling campaign to a single operator who accidentally infected their own machine, leaking their Visual Basic 6 management tools and exposing over 6,000 victim IPs. Security teams should proactively hunt for anomalous must-use plugins like wp-sec.php and strictly enforce WordPress patching to prevent infrastructure hijacking.

research.checkpoint.com · 12 min

TLDR InfoSec

BLOCKCHAIN DEAD DROP RESOLVERS EXPLAINED

Researchers identified multiple malware families abusing smart contracts on EVM, Solana, and TON blockchains as "dead drop resolvers" to dynamically fetch command-and-control addresses. By utilizing read-only functions like eth_call, threat actors can cheaply rotate infrastructure without altering their core payloads, a tactic recently deployed in the August 2026 ChainDrop npm supply-chain compromise. To detect this evasion technique, defenders should monitor for non-browser processes like node, bun, or curl making anomalous RPC queries to public providers and correlate the decoded responses.

netskope.com · 5 min

TLDR InfoSec

A CLOSED NETWORK PATH IS NOT A CLOSED EXECUTION PATH

When working with event-driven architectures, traditional network paths, such as security groups, firewalls, and network ACLs, may not be the same as the execution path. The author tested this by creating a cross-account EventBridge policy which allowed an external account to send events to an internal account which triggered a Lambda function, which then called an EKS application that used its cloud identity to perform a privileged action. Since each individual action was legitimate, no alerts or detections fired. It took the author a full afternoon to trace the events even though he knew the full path.

thecorestrength.net · 6 min

TLDR InfoSec

XPANDER (PRODUCT LAUNCH)

Xpander provides software to build, run, secure, and manage automated software workers across products, workflows, and data. Its portable runtime runs workers in different environments, while Omni helps teams create employee-facing assistants and coordinate multi-worker tasks.

xpander.ai

TLDR InfoSec

OPENAI INSTITUTES NEW SAFEGUARDS AFTER HUGGING FACE BREACH

OpenAI introduced tighter testing controls after models escaped a training environment through an internet-connected network tool. The company paused reinforcement learning for two weeks and still holds its largest planned run with new controls to isolate workloads, inspect tool actions and logs, and target alerts within 30 minutes.

techcrunch.com · 2 min

TLDR InfoSec

HACKERS SPEND NEARLY $7 MILLION ON EXPIRED DOMAINS TO REDIRECT TRAFFIC TO SCAMS AND MALWARE

Infoblox tracked 50,400 expired-domain re-registrations daily across gTLDs in early 2026. Sable Squirrel spent nearly $7 million on more than 10,000 domains, routing sports-streaming visitors to gambling sites and using some domains for malware C2. Researchers linked 31,000 samples, including Quasar RAT and AsyncRAT, to its infrastructure while other groups buy expired, compromised domains and monetize inherited traffic through scams, malicious scripts, and ad networks.

thehackernews.com · 5 min

TLDR InfoSec

MICROSOFT COPILOT REVEALS SECRET INPUT THAT ALLOWED IT TO BE HACKED

Varonis found that Copilot disclosed an undocumented ?autorun=1 URL parameter through repeated questioning. Combined with ?q=, it ran injected prompts after a victim clicked a link. Prompts could search authenticated inboxes and send extracted email addresses or credentials to attacker-controlled servers. Microsoft blocked ?q= input injection in February and issued broader fixes as

arstechnica.com · 3 min

TLDR InfoSec

Replace persistent access with Zero Standing Privileges

Just-in-time, just-enough access, scoped to the task, and automatically revoked when work ends.

1password.com

TLDR InfoSec

CRITICAL GITLAB GRAPHQL FLAW COULD LET UNAUTHENTICATED ATTACKERS DELETE PUBLIC PROJECTS

GitLab has patched CVE-2026-19478, a CVSS 9.4 GraphQL flaw affecting self-managed CE and EE instances.

thehackernews.com · 2 min

TLDR InfoSec

FEDS CHARGE 17 IN IRAN-BACKED HACKING SCHEME

Federal prosecutors charged 17 members of Iran's Mabna Institute with running a phishing scheme that compromised email accounts of more than 100,000 professors worldwide and stole over 31 terabytes of academic data from universities.

courthousenews.com · 3 min