The Daily Index — Tuesday, September 1, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ANTHROPIC WARNS CLAUDE USERS OF INFOSTEALER MALWARE INFECTIONS

Anthropic warned affected Claude users that infostealers hijacked browser sessions and drained usage limits. The malware included Vidar, Lumma, StealC, RedLine, Acreed, and AMOS. Anthropic logged out compromised sessions, removed stored payment methods, and refunded identified unauthorized charges. Users should remove malware before re-adding payment details.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

PHILIPPINE NUCLEAR AGENCY AND NAVAL CONTRACTOR TARGETED BY SUSPECTED CHINESE-SPEAKING OPERATOR USING KNOWN VULNERABILITIES

Researchers found an exposed Amsterdam server staging tools and stolen Philippine data. Custom scripts abused ownCloud CVE-2023-49105, impersonating known users through unsigned WebDAV URLs. The recovered data included reactor records, radiation-safety files, employee PII, travel documents, BitLocker keys, KeePass data, and AxCrypt files. Logs referenced roughly 9 GB taken from the nuclear agency. A naval contractor's WordPress site was breached through LiteSpeed Cache CVE-2024-28000 and XML-RPC password guessing. The server also hosted Sliver, Metasploit, Mettle, and a loader that fetched a second-stage payload.

hunt.io · 12 min

TLDR InfoSec

INTRODUCING ADAPTIVE INTELLIGENCE: UNDERMINING THE ECONOMICS OF EVERY BOT ATTACK

Cloudflare has launched Adaptive Intelligence, a bot detection engine designed to make evasion economically unviable for attackers by continuously retraining its models on live traffic. Rather than relying on deterministic rules, the engine utilizes non-deterministic signal weighting and delayed reactions to prevent threat actors from isolating and defeating specific defenses. This cross-temporal evaluation allows the system to detect slow credential-stuffing attacks distributed across residential proxies that would otherwise bypass standard rate limits. Enterprise customers can activate the continuous retraining component immediately by enabling "Auto Update Machine Learning" in their Bot Management dashboard, while advanced features such as disposable rule generation are still in development.

blog.cloudflare.com · 10 min

TLDR InfoSec

OEMPOCALYPSE NOW

Calif researcher Lukas Maar has developed a universal exploitation strategy that elevates an unprivileged Android app to root across modern Samsung, Xiaomi, and Oppo devices. Rather than hunting for generic kernel or chipset vulnerabilities, Maar targeted the proprietary OEM software overlays, such as One UI and HyperOS, that span each vendor's entire device lineup. The exploit leverages a page use-after-free vulnerability mapped to a freed physical page. This reliable technique successfully bypasses KASLR, control-flow hijacking, and slab protections without modification across kernels 5.4 through 6.12. While this initial publication outlines the overarching methodology on locked bootloaders, Maar plans to release the specific exploit chains affecting July 2026 flagship devices like the Galaxy S26 Ultra in future installments.

blog.calif.io · 2 min

TLDR InfoSec

OPEN-SOURCE POST-QUANTUM CRYPTOGRAPHY SERVERLESS CA

Paul Schwarzenberger updated his open-source serverless CA with support for ML-DSA post-quantum cryptography. CA private keys are generated and used within AWS KMS FIPS 140-3 HSMS. ML-DSA is still not universally supported by applications, so users should check compatibility before adopting.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

HOW AI BUILDERS WILL GET HACKED

Developers who are frequently building tools with AI should ensure that they have a continuously running system that maintains a list of publicly exposed systems and continuously probes for basic security properties. AI builders can consider using full harnesses to comprehensively test critical systems. With the velocity of AI development, losing track of dangling, public resources will become a key attack vector.

danielmiessler.com · 4 min

TLDR InfoSec

DATA SECURITY INCIDENT - 27.08.26

Manchester Airports Group says an unauthorized party obtained booking and Wi‑Fi signup data from Manchester, Stansted, and East Midlands airports.

manchesterairport.co.uk · 2 min

TLDR InfoSec

UPDATE ON RECENT CYBERSECURITY INCIDENT

Boston Scientific detected a cyber incident on August 25 that disrupted on-premises operating systems and business applications.

news.bostonscientific.com · 4 min