The Daily Index — Wednesday, September 9, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

WEWORM

Calif has demonstrated a zero-click worm that takes over a WeChat account via an unanswered VoIP call, then uses that account to call the victim's contacts. This exploit relies on a memory corruption bug in WeChat's VoIP stack and requires the attacker to be on the victim's friend list, which is a weak barrier since one compromised friend can lead to further exploitation. Tencent has mitigated this issue in server-side updates and in client versions Android 8.0.77 and iOS 8.0.76, so users should enforce these updates and reconsider trusted-contact privileges in messaging apps.

calif.io · 4 min

TLDR InfoSec

HACKERS BREACH F5 BIG-IP APM DEVICES TO DEPLOY LINUX ROOTKIT

There is a malware campaign targeting F5 BIG-IP APM devices that exploits a critical RCE vulnerability and injects a fileless web shell. A distinct installer deploys the payload by infecting the Apache executable and modifying SELinux configurations. ESET researchers identified the malware as PoisonedRefresh.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKING AI CUSTOMER SERVICE AGENTS

Researchers demonstrated attacks against customer-support agents through email spoofing, duplicate From headers, out-of-office replies, and email-address parser mismatches. These flaws can trigger profile changes, refunds, phishing emails, or account data disclosure. Alternatively, other paths reset OTP rate limits, abuse IVR checks, and steal third-party reset codes from monitored support inboxes. Hidden instructions in alternate MIME parts, CSS-hidden text, and attacker-controlled images can mislead automated processing. Untrusted forum comments and namespace-controlled sitemap pages can also poison support knowledge bases.

intigriti.com · 11 min

TLDR InfoSec

RFD 301: HAS ANYBODY SEEN MY KEYS?: A KEY-HIERARCHY STRATEGY FOR RACK-LEVEL SECURITY

Oxide published its internal design for protecting rack data at rest, rooting everything in a Shamir-shared rack secret that no attacker can recover without stealing at least K sleds or M.2 drives. Per-drive ZFS wrapper keys are derived with HKDF using SHA3-256 and an info string built from the PCI vendor ID, drive model, and serial number, so compromising one disk key leaves the others intact. The harder problem is rotation across a distributed two-phase commit: the dealer encrypts the epoch N-1 rack secret under a key derived from the epoch N secret using chacha20poly1305, keeping the old secret unrecoverable until the new configuration commits.

rfd.shared.oxide.computer · 12 min

TLDR InfoSec

THE SHARED CLIPBOARD INSIDE THE SANDBOX: CROSS-ACCOUNT DATA LEAKAGE IN CHATGPT

Check Point Research discovered that ChatGPT code-execution containers from different accounts were using package metadata as a covert cross-account channel because these containers could read and write item properties on the same internal JFrog Artifactory instance. This allowed attackers to deliver a planted instruction through a shared conversation, a custom GPT, or a pasted prompt. The model would then run a hidden second task stream in the same turn, pulling data from the victim's connected Gmail while the visible answer stayed clean. Although OpenAI has decommissioned that Artifactory instance, defenders should enable per-session isolation for any mutable state in shared internal services and review default low-risk reads configuration.

research.checkpoint.com · 10 min

TLDR InfoSec

FAKE IT CALLS TARGET EXECUTIVES IN MICROSOFT 365 DATA THEFT AND EXTORTION ATTACKS

PREY-0058 targets executives through fake IT help-desk calls and authentication-themed domains. Its AitM pages capture Microsoft 365 credentials, MFA approvals, and session tokens. Operators replay tokens through residential proxies, then enumerate SharePoint and Entra ID. They bulk-exfiltrate SharePoint, OneDrive, Exchange, and Box data before issuing extortion demands. Defenders are advised to watch for proxy token replay, mailbox harvesting, and new MFA-themed domains.

thehackernews.com · 2 min

TLDR InfoSec

UK FOOD SUPPLY CHAIN AT RISK FROM HOSTILE ATTACKS

The National Audit Office named cyberattacks as a threat to the UK food supply chain. Marks & Spencer estimates its April 2025 attack cost £136 million after warehouse systems were disconnected, and the Co-op confirmed theft of 6.5 million member records. Several food supply chain organizations cited the substantial investments businesses are making to manage the threat and incidence of cyber-attacks.

theregister.com · 2 min

TLDR InfoSec

PASSKEYS AND WEBAUTHN EXPLAINED

This walkthrough covers passkey registration and login end-to-end, from server-issued challenges and stored public keys to SimpleWebAuthn verification in Node. Phishing resistance comes from RP ID scoping, which browsers enforce, but servers must still verify alongside exact origin, challenge freshness, and user verification. Teams tend to underestimate single-use challenges, concurrent login tabs, credential management screens, and recovery paths that end up weaker than the login they back up.

flaviocopes.com · 8 min

TLDR InfoSec

resilience. Get the Ebook

Summary unavailable

flexential.com

TLDR InfoSec

GRINDR PAYS £26M TO SETTLE UK LAWSUIT OVER ALLEGEDLY SHARING USERS' HIV STATUS

Grindr agreed to pay £26m to settle a UK privacy claim involving 12,000 users as the suit alleged pre-2020 sharing of sensitive data, including HIV status, with advertising firms.

theguardian.com · 2 min

TLDR InfoSec

NEW ANDROID RAT USES WORM TO TARGET EXPOSED ADB SERVICES

Dark Atlas has documented THost9, an Android RAT whose worm component scans for internet-exposed ADB services and authenticates with prepared keys to install itself, giving operators shell access, file transfer, and tunneling on affected phones and Redroid containers.

scworld.com · 1 min

TLDR InfoSec

MICROSOFT PLUGS NEARLY 1,000 SECURITY HOLES

Microsoft has released 974 patches, its largest batch ever, including two actively exploited privilege-escalation zero-days and 113 critical vulnerabilities.

krebsonsecurity.com · 2 min