The Daily Index — Wednesday, September 2, 2026 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

Flashpoint's Global Threat Intelligence Report (Midyear Edition)

is built on 3.9 petabytes of primary-source data collected directly from the spaces where this activity happens. Readers will learn: * How the threat landscape is shifting from human-led campaigns to AI-led, machine-speed exploitation * Why 19% of the 21,667 vulnerabilities [6]disclosed in H1 2026 already had public or functional exploit code * The five groups behind 44% of all attacks

go.flashpoint.io

TLDR InfoSec

RECENTLY PATCHED PAPERCUT ZERO-DAYS USED IN DATA THEFT ATTACKS

PaperCut Software announced two new vulnerabilities that have been patched in its PaperCut NG and MF print management software. The vulnerabilities involve an authentication bypass vulnerability which can be chained with a separately disclosed vulnerability to achieve RCE. Threat intelligence firm Defused reports that the authentication bypass vulnerability is being exploited by attackers for data theft.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKERS TARGET AWS ROOT ACCOUNTS AT 150+ ORGANIZATIONS WITH PASSWORD SPRAYING ATTACK

Datadog Security Labs uncovered a password spraying campaign targeting AWS root accounts. Datadog stated that it has not identified a successful login yet, making the attacker's motive unclear. AWS root account logins require an account email, so it is possible that the attackers have access to a dataset or exposed email addresses that they are using in their campaign.

cyberpress.org · 2 min

TLDR InfoSec

DON'T LET ABLITERATION ABLITERATE YOUR BUG HUNTING: DISCOVERING VERDICT BIAS IN UNCENSORED MODELS

Tests of Gemma and Qwen builds found that abliterated variants approved of far more vulnerability candidates. In FreeBSD's sys/rpc, one Heretic build marked 138 of 144 candidates VALID, while the base marked 26 of 40. The Heretic run missed CVE-2026-4747 after spending its scan on false findings. A false heap-overflow claim survived because abliterated builds described the buffer bound, then still confirmed an overflow.

clearbluejar.github.io · 17 min

TLDR InfoSec

CAN AI CREATE PLC ATTACKS? YES, BUT IT'S NOT THAT EASY YET

Forescout used an AI model to port an RCE exploit from a WAGO 750-852 PLC to a 750-831 PLC running the same vulnerable Nucleus FTP server (CVE-2021-31886). The AI needed constant human guidance: correcting false leads, supplying disassembly context, and running Ghidra scripts it wrote itself. The final exploit stage took 8 hours 32 minutes and cost $535.74 in API tokens. A follow-up attempt to build a C2 implant bricked the PLC. Once code execution worked, the AI wrote working ICMP and UDP payloads within minutes.

forescout.com · 8 min

TLDR InfoSec

SPRING RING: AN INSIDE LOOK AT VOICE PHISHING CAMPAIGNS IN MICROSOFT TEAMS

Threat actors are executing voice phishing campaigns by registering external .onmicrosoft[.]com tenants with fake help desk names, initiating Microsoft Teams chats, and escalating to calls to trick victims into launching remote management tools. Following initial access, the attackers deliver distinct payloads that include an obfuscated PowerShell RAT designed to disable AMSI via the amsiInitFailed flag, and a Python-based execution chain that attempts PetitPotam coercion against domain controllers over port 445. To mitigate this threat, organizations must restrict external Teams access by default, block the associated payload hash, and proactively hunt for rapid chat-to-call sequences originating from commercial VPN nodes.

unit42.paloaltonetworks.com · 11 min

TLDR InfoSec

BRITISH PUBLIC OPPOSE SECRET SURVEILLANCE POWERS AND WANT STRONG PROTECTIONS FOR ENCRYPTED COMMUNICATIONS

CDT polling of 2,000 UK adults found 53% judge encryption-access security risks greater than law-enforcement benefits. 84% fear hidden access would create exploitable vulnerabilities, fraud, data leaks, and cybercrime. The findings follow Apple's tribunal challenge to UK Technical Capability Notices after a demand for encrypted iCloud access.

cdt.org · 3 min

TLDR InfoSec

CATO CTRL INSIGHTS: WHEN TRUST BECOMES THE PAYLOAD IN A FAKE CODEX CLICKFIX CAMPAIGN

Sponsored Codex searches routed macOS users to Google Sites lures with attacker-controlled iframes. Fake installers copied Terminal commands that decoded URLs, fetched shell loaders, and launched Mach-O payloads from /tmp/helper. The chain sent event=pasted telemetry, cleared quarantine attributes with xattr -c, and showed delivery overlap with AMOS.

catonetworks.com · 8 min

TLDR InfoSec

Replace persistent access with Zero Standing Privileges

Just-in-time, just-enough access, scoped to the task, and automatically revoked when work ends.

1password.com

TLDR InfoSec

CRITICAL JFROG ARTIFACTORY VULNERABILITY REPORTEDLY EXPLOITED IN THE WILD

Attackers reportedly began exploiting CVE-2026-82329 days after disclosure, minting admin tokens in vulnerable JFrog Artifactory deployments.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ALIEXPRESS ACCUSED OF FINGERPRINTING SHOPPERS WITH SILENT AUDIO TRICK THAT ALSO MUTED A DEV'S HEADPHONES

AliExpress scripts generate inaudible WebAudio sawtooth signals, collect frequency data, and query display size, memory, plugins, WebGL, and mouse activity.

theregister.com · 3 min