The Daily Index — Monday, September 7, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ATTACKERS EXPLOIT PAPERCUT FLAWS TO STEAL CREDENTIALS FROM SCHOOLS AND UNIVERSITIES

Threat actors are chaining CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution pair in PaperCut, to steal credentials from K-12 schools and major universities across the US and Europe. Users are advised to restrict PaperCut servers from being exposed to the internet and to monitor for the execution of cmd.exe, powershell.exe, or other scripting and command interpreters, as well as commands containing whoami, tasklist, ver, or uname -a, with pc-app.exe as the parent process.

thehackernews.com · 2 min

TLDR InfoSec

THOMSON REUTERS DETECTS CYBERSECURITY INCIDENT, SAYS UNAUTHORIZED PARTY ACCESSED FILES

Thomson Reuters found unauthorized access to C-Track files in March. The June 30 incident affected court systems in 11 US states, the US Virgin Islands, and Ontario. Exposed records may contain names and personal information. The company contained the activity, notified customers and law enforcement, and said C-Track remained operational.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

IMPROVING OUR ALIGNMENT AND SECURITY EFFORTS

Anthropic paused cyber evaluations after three July incidents exposed real systems through third-party environments. It added real-time classifiers, stronger sandbox isolation, and outbound network blocks, while partners testing reduced-safeguard models must verify isolation, define scope, validate tasks, and stop violations. The company also froze RL environment changes, flagged over 10% for defects, and rebuilt review controls.

anthropic.com · 12 min

TLDR InfoSec

TURNING CHROME REMOTE DESKTOP INTO PURE RED TEAM OPS

A researcher at ZeroTrace Lab went down a rabbit hole to try and understand how they can disable the Chrome Remote Desktop connection banner after it was bothering them on a computer they remote into. This led to a reverse engineering journey that ended with them creating a script to patch the modal's x and y size variables to 0, resulting in the banner not being visible. After realizing the spyware/red team potential this opened, the researcher continued reversing and found that they could create a malicious msi installer that would install a tampered hosts.json and patched modal to allow for remoting by an attacker with no visible notification to the victim.

zerotracelab.com · 12 min

TLDR InfoSec

ABABIL OF MINAB: AN IRAN-LINKED DESTRUCTION AND EXFILTRATION CAMPAIGN TARGETING THE US AND THE MIDDLE EAST

Gambit Security tied Ababil of Minab, the pro-Iranian persona that claimed responsibility for the attack on LA Metro in March, to Black Shadow, an Iran-linked group that the Israel National Cyber Directorate attributed to Iran's Ministry of Intelligence and Security, undercutting the crew's claim to be a new standalone hacktivist outfit. The campaign combined exfiltration with destruction across four confirmed victims in the United States, Israel, Saudi Arabia, and Turkey, mixing scripted automation with hands-on-keyboard work through vCenter, Disk Management, SQL Server Management Studio, and Veeam consoles, including one run that dropped 58 SQL Server databases at Vyncs. Analysts also found additional Israeli and Turkish victims on the operator's staging infrastructure, custom exfiltration tooling in the form of a Flask receiver and a C++ uploader named FileFiend, and a briefly exposed browser session showing the operator using ChatGPT to refine the destruction script.

gambit.security · 9 min

TLDR InfoSec

ANOTHER SWARM OF OPENAI AGENTS REACHED THE OPEN INTERNET WITHOUT THE FRONTIER LAB'S KNOWLEDGE

Researchers found OpenAI-linked agents editing a little-used German wiki from May through June. 3,700 agents posted 18,000 messages and shared answers for timed web-search tests while trying to hide posts with “ZZZ.”. A moderator deleted roughly 100 pages daily while agents created about 400 pages a day. Activity dropped after OpenAI noticed the incident and intervened.

techcrunch.com · 3 min

TLDR InfoSec

GPT-6 ASTRA SCORES 100% ON EXPLOITBENCH AS OPENAI BLOCKS POC EXPLOIT REQUESTS

OpenAI released GPT-6 Astra after it scored 100% on ExploitBench, up from GPT-5.6 Sol's 78.5%. Testing found higher rates of arbitrary code execution and two undisclosed zero-days. The public release allows secure code review and patching while it refuses proof-of-concept exploit requests. OpenAI plans to restrict Daybreak access for defenders, including MS-ISAC participants.

thehackernews.com · 3 min

TLDR InfoSec

G7 URGES ORGANIZATIONS TO PREPARE FOR QUANTUM CYBER THREATS

The G7 Cyber Security Working Group and CISA issued a joint advisory urging organizations to begin migrating to post-quantum cryptography now.

therecord.media · 2 min

TLDR InfoSec

EVALUATING MUSE SPARK 1.3 ON HACK THE BOX CHALLENGES

Muse Spark 1.3 scored 72.9% on the HTB-Challenger benchmark, up from 50.41% for version 1.2 just one month earlier.

theaq.blog · 2 min

TLDR InfoSec

BOOZ ALLEN CYBER WEAPON INDEX MEASURES DEMONSTRATED AI CYBER CAPABILITIES

Booz Allen tested 18 US and Chinese models on attacker machines against a production-grade enterprise network.

boozallen.com · 3 min