The Daily Index — Friday, September 4, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CODER'S REGISTRY INFRASTRUCTURE COMPROMISED TO PUSH MALICIOUS MODULES

An attacker added unauthorized IPs to Coder's Cloudflare pool for registry.coder.com and served credential-stealing Terraform modules between 07:35 and 21:45 UTC on August 31, exfiltrating cloud, CI/CD, OIDC, and SSH secrets to coder-infra[.]com. Patched releases are 2.37.0, 2.36.4, 2.35.7, and 2.34.9.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ROGUE SCREENCONNECT INSTALLATIONS ACROSS UNRELATED HOSTS SUGGEST WORM-LIKE ACTIVITY

Modified ScreenConnect clients recovered by Huntress watch the EndPointStatusMessage.Connections collection for newly observed Host sessions, then register 1.vbs through 4.vbs with ScreenConnect's virtual file-transfer system and queue them with the action set to Run, so merely connecting to an infected client can hand the Host the same four-stage VBScript chain. The loader profiles first: 1.vbs writes a three-bit state to %TEMP%\value.txt covering existing ScreenConnect installs, whether Defender is the only endpoint protection present, and whether RAM exceeds 5GB, and that value selects a user-level backdoor, an access package with a ComputerDefaults.exe UAC bypass and AMSI tampering, or a combo branch carrying wstunnel disguised as Themes.exe and XMRig renamed SearchIndex.exe. Defenders should treat RunFiles or RanFiles entries in ScreenConnect server audit logs showing those scripts executed from Process: Guest as indicators of compromise, check for the WindowsServiceHost Run key pointing at WindowsServiceHost.vbs in AppData, and note that Huntress recommends reimaging affected hosts rather than cleaning them.

huntress.com · 10 min

TLDR InfoSec

FROM PATCH TO EXPLOIT; USING CLAUDE CODE TO REVERSE ENGINEER A ZERO-DAY IN PAPERCUT NG

Kev Breen used Claude Code against a patched PaperCut NG zero-day, spotting SQL injection IoCs in error logs and finding the patch blocked CALL/EXEC/SYSCS_ calls in the SQL lookup template. Claude decompiled the JARs, found an auth-bypass filter flaw using a matrix parameter, then a second bypass in pageValidate letting an unauth service parameter reach admin pages. Chaining both gave unauthenticated RCE via arbitrary file write as the papercut user, confirmed with a working Python PoC. A guardrail swapped the model mid-session when it probed exploitation logs. Breen later found a third bypass defeating the emergency patch and reported it to security@papercut.com, who said they were already aware.

techanarchy.net · 13 min

TLDR InfoSec

THE OUTSIDER PHISHING KIT: A RESILIENT THREAT IN THE FACE OF LAW ENFORCEMENT ACTION

Despite recent takedown efforts by Google and the FBI, the ChenLun Outsider Phishing-as-a-Service platform has proven highly resilient, with over 700 new phishing pages deployed in a single month. The platform operates a sophisticated kill chain that utilizes WebSockets to stream victim keystrokes in real time while allowing affiliates to manually push contextual 2FA prompts on demand. Defenders can hunt for this infrastructure across all known templates by looking for the unique GetSyncSetting configuration file and an alphabetical page prefix convention that maps directly to the victim exploitation stage.

group-ib.com · 15 min

TLDR InfoSec

AIR SECURITY (PRODUCT LAUNCH)

AIR Security launched a firewall that inventories and evaluates skills, plugins, MCP servers, and add-ons. It detects malicious instructions, hidden behavior, excessive permissions, typo-squatted packages, and risky updates, then revokes access across dependent workflows.

air.security

TLDR InfoSec

AWSHOUND: AN OPENSOURCE AWS OPENGRAPH COLLECTOR

AWSHound is a self-hosted open-source collector that maps AWS environments into BloodHound OpenGraph datasets to visualize attack paths. Unlike existing mapping tools, AWSHound performs strict offline IAM evaluations by intersecting identity policies with permissions boundaries and SCPs to ensure relationships are only drawn where effective permissions resolve to an explicit allow. Operating securely through standard AWS SDK credential chains, the tool demonstrated massive scalability during internal testing by mapping a 500-account organization into 10.5 million edges in approximately 15 minutes.

specterops.io · 20 min

TLDR InfoSec

UK MOVES TO BLOCK HIGH-RISK TECH SUPPLIERS FROM CRITICAL INFRASTRUCTURE

UK ministers tabled amendments to the Cyber Security and Resilience Bill on August 24. The changes let them block high-risk technology suppliers from critical sectors. The move followed an Iran-linked attack that shut a UK energy facility for four days. The bill already mandates tight incident reporting and penalties, and SMEs supplying critical operators may face exclusion without adequate controls.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

OPENAI'S NEW REASONING TECHNIQUE ALARMS AI SAFETY EXPERTS

OpenAI's Astra model uses "recurrent depth," letting it loop through the same query multiple times instead of reasoning step by step, which makes chain-of-thought logs harder to read. Scaling the technique could push reasoning fully into latent space, killing visibility into model behavior. OpenAI's Jakub Pachocki said Astra's chain of thought stays legible and that monitoring remains a research priority.

techcrunch.com · 3 min

TLDR InfoSec

AI AGENTS HELP COMPRESS RANSOMWARE INTRUSION TO UNDER 10 HOURS, RAISING STAKES FOR CISOS

A ransomware operator crossed an enterprise network in under 10 hours using AI agents, work Unit 42 estimated would have taken human hands roughly two weeks. The 50-plus ATT&CK techniques observed were unremarkable on their own, and analysts quoted here read the intrusion as human-directed, with AI handling delegated tactical work rather than anything approaching autonomy. The more durable observation is about transitive authority, where a repository account with no cloud admin rights can still alter a workflow that assumes a privileged cloud role, which is the gap that made speed matter.

csoonline.com · 5 min

TLDR InfoSec

VALLEYRAT BACKDOOR DISGUISES ITSELF AS ADWARE

Kaspersky found ValleyRAT hiding inside a modified build of the Chinese adware QN Wallpaper, sideloading a malicious libcef.dll through the signed QnWallpaper.exe to gain a trusted parent process that users routinely whitelist.

hackmag.com · 3 min

TLDR InfoSec

RUSTBOT, THE MACOS MALWARE USED IN THE LATEST RUST SUPPLY CHAIN ATTACK

Poisoned crates.io releases of arrayref, internment, and append-only-vec pulled in a malicious build-time dependency that fetched an arm64 Mach-O implant during cargo build, harvesting ~/.aws, ~/.ssh, and ~/.kube credentials before its RSA tasking channel was neutered by the private key shipping inside the binary.

iru.com · 7 min