The Daily Index — Thursday, August 20, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SAKURA INTERNET HACK EXPOSES DATA OF UP TO 1.36M ACCOUNTS

Japanese cloud and data center provider Sakura Internet disclosed that hackers accessed its sales management system, exposing data of 1.36M users. Sakura detected the hack while investigating another incident involving unauthorized access to 538 accounts. Sakura is currently notifying customers and relevant authorities.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKERS COMPROMISE 14,500 DAHUA WEB CAMERAS IN 35-DAY CAMPAIGN

Researchers at Hunt.io uncovered a hacking campaign that targeted Dahua IP cameras, mostly in Ukraine and Russia. Hunt.io discovered the campaign by finding a working directory on an HTTP server that the operators left unprotected. The threat actors compromised 12,234 cameras by brute-force scanning on TCP port 37777, 1,923 cameras by exploiting known vulnerabilities using a tool called p2pwn, and 283 cameras that were behind NAT using only serial numbers and SDK credentials embedded in Dahua applications.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKING YOUR LIFE WITH AI CAN GET YOU HACKED

Endor Labs found 14 critical and high-severity flaws across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Airflow. Several described paths allowed unauthenticated remote code execution, prompt-driven code execution, sandbox escapes, command injection, or data theft. Flowise, Kestra, and Langflow exposed exploitable paths without sign-in under some configurations.

endorlabs.com · 8 min

TLDR InfoSec

BREAKING SECURE BOOT WITHOUT BREAKING THE CRYPTO

A signature check alone doesn't prove a device is safe. This post breaks secure boot into four failure buckets: did the check run, did it cover the right bytes, was the signer authorized, and do those bytes still run at execution time? It walks through Qualcomm's PBL/XBL-SC/TME chain, Android Verified Boot, DICE key derivation, and RATS attestation roles. Real CVEs illustrate each bucket: CVE-2019-2278 let a rejected keystore still verify a boot image, CVE-2023-48425 chains an AVB failure into a full bypass on a retail Chromecast, and CVE-2021-1931 lets one signed image authorize a different one.

0x434b.dev · 57 min

TLDR InfoSec

YOUR BENIGN SET SHOULD LOOK MALICIOUS

When testing detections to establish a false positive rate, it is common to build a set of benign data that should not be flagged. However, often the benign set is too benign and leads to artificially deflated false positive rates because the traffic doesn't resemble data that could be malicious. Instead, organizations should draw upon their internal docs, examples, etc to find negatives that matter to the organization and build a benign set that includes those.

pipelab.org · 6 min

TLDR InfoSec

infrastructure organizations already trust. ThreatDown

researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [10] report.

threatdown.com

TLDR InfoSec

SHAZZER TEAMS: COLLABORATIVE FUZZING

Shazzer Teams lets security researchers pool browser resources on a private distributed fuzzing network separate from the public pool while sharing a common vector library. Owners manage membership through expiring, usage-limited invite links and role-based permissions, and any member's browser automatically joins the team's fuzzing pool when the Network page is open.

shazzer.co.uk · 3 min

TLDR InfoSec

RANSOM BUSTERS CLAIMS IT HACKED RANSOMWARE SERVERS, ASKS VICTIMS FOR UP TO $60,000

Ransom Busters emailed ransomware victims, seeking $20,000 to $60,000. It claimed access to ransomware servers and offered file recovery and deletion of stolen data. GuidePoint linked two incidents through shared tooling, a “Numlock!123” backdoor account, and hostname DESKTOP-BBETH6K. The activity may be a ransomware affiliate posing as a recovery service, but payments cannot verify data deletion.

thehackernews.com · 5 min

TLDR InfoSec

CHINA DIRECTS STATE AGENCIES TO UNINSTALL CUSTOM WINDOWS 10 EDITION OVER SECURITY CONCERNS

China's Ministry of State Security has ordered state-linked organizations to immediately uninstall the custom Windows 10 CMIT edition due to data security concerns regarding foreign software reliance. This sweeping directive abruptly accelerates the retirement of the operating system originally developed through a 2016 joint venture with Microsoft. The government had previously scheduled the highly modified software to remain in active use until February 2027.

wccftech.com · 2 min

TLDR InfoSec

MLFLOW BUG ACTIVELY EXPLOITED TO STEAL CREDENTIALS

Organizations running MLflow versions prior to 3.15.0 must urgently patch to mitigate an actively exploited Server-Side Request Forgery vulnerability (CVE-2026-64849) that allows unauthenticated attackers to steal cloud credentials via DNS rebinding and malicious webhook redirects.

decipher.sc · 2 min

TLDR InfoSec

I'M WORRIED ABOUT A PROMPT INJECTION WORM

A prompt-injection worm could exploit AI agents parsing external inputs, such as emails, to exfiltrate data and propagate through victims' communication channels, so organizations should map AI integrations, model access levels, and build AI-specific incident response plans.

danielmiessler.com · 2 min