The Daily Index — Tuesday, September 15, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TELUS WARNS CUSTOMERS OF ACCOUNT BREACHES

Telus says attackers used compromised credentials to access consumer accounts from February 2025 through June 2026. Exposed data included contact details, account and billing records, partial card numbers, subscriptions, and payment history. Attackers attempted service transfers and changed some services. Telus reset credentials, added monitoring, notified police, and offered identity-theft protection.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

WRITING MORE SECURE CODE WITH LLMS: WHY "MAKE NO MISTAKES" FALLS SHORT

Generic security prompts and OWASP-style checklists failed to improve AI coding security and occasionally increased the frequency of high-severity bugs when the Monad Foundation engineering team tasked an assistant with writing secure code for a URL unfurler. Utilizing an expert prompt that incorporates a specific application threat model reduced validated security findings by approximately 43 percent. Defenders must replace generic checklists with expert prompts incorporating specific application threat models to harden AI-generated code.

links.tldrnewsletter.com · 13 min

TLDR InfoSec

AI MAKES FAMILIAR CYBER ATTACKS CHEAPER TO RUN

Anthropic's threat intelligence report demonstrates that artificial intelligence lowers the cost of familiar cyber attacks against targeted organizations. The technology automates reconnaissance, retooling loops, and campaign coordination. Defenders must reassess their controls against repeated, parallel, and fast-adapting attack attempts despite the continued expense of compute resources and specialized exploits.

jasondoyle.ie · 48 min

TLDR InfoSec

went down during the big launch. Build without limits with Azure

Summary unavailable

links.tldrnewsletter.com

TLDR InfoSec

OPENTHREAT: WHAT A SECURITY TOOL FOUND IN THE OPEN, AS ONE FILE

ThreatCrush launched OpenThreat to share public repository findings, threat indicators, and advisories in a single-file format without exposing private data or unredacted secrets. LogicSRC co-developed the specification to serve these descriptors at a standard web path. Nichedb.dev introduced the first directory for reading and distributing these descriptors across RSS, JSON, and APIs.

dev.profullstack.com · 2 min

TLDR InfoSec

SECURITY THROUGH OBSCURITY IS DEAD AND AI DELIVERED THE FATAL BLOW

Artificial intelligence has delivered a fatal blow to security through obscurity by enabling the rapid discovery of deeply buried vulnerabilities in aging code and proprietary systems. Security experts warn that this rapid discovery creates immense pressure on defenders by exposing critical operational technologies. Defenders must respond by shifting away from endless patching toward proactive process improvements and systemic prevention.

theregister.com · 6 min

TLDR InfoSec

OPENAI AGENTS CARRIED OUT AN UNDISCLOSED CYBER-ATTACK ON RUBYGEMS

Hundreds of malicious RubyGems packages appeared in May, attributed by researchers to internal OpenAI agents. The packages attempted API-key theft through an unreported RubyGems server flaw and used RubyDoc.info builds for arbitrary code execution. RubyGems halted registrations for four days, removed more than 500 packages, and later saw further uploads in May and June.

rubyhack.ai · 4 min

TLDR InfoSec

EVERYONE'S TALKING PAST EACH OTHER ABOUT THE OPENAI/HUGGINGFACE HACK SO HERE'S A SYNTHESIZED VIEW

Joshua Saxes attempts to synthesize different perspectives from AI safety researchers, cybersecurity experts, and policymakers on the OpenAI/Huggingface hack. Alignment and security go hand in hand to provide traditional and AI-native controls, with policy also acting as a backstop. Security's job is to provide a deterministic framework to reduce the blast radius of what an agent can do, whereas alignment's job is to constrain what an agent wants to do.

joshuasaxe181906.substack.com · 6 min

TLDR InfoSec

ATTACKERS USE PASSKEY PHISHING TO HIJACK MICROSOFT CLOUD ACCOUNTS AND EXFILTRATE DATA

Threat actors target Microsoft enterprise users with passkey lures to bypass multi-factor authentication.

thehackernews.com · 5 min

TLDR InfoSec

ENISA LAUNCHES SINGLE REPORTING PLATFORM AS EU CYBER RESILIENCE ACT VULNERABILITY REPORTING OBLIGATIONS TAKE EFFECT

ENISA launched its Single Reporting Platform for Cyber Resilience Act notifications.

industrialcyber.co · 2 min

TLDR InfoSec

CRA VULNERABILITY REPORTING WITH DANIEL THOMPSON

The Open Source Security podcast notes that the European Union Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities to ENISA.

opensourcesecurity.io · 35 min