The Daily Index — Friday, September 18, 2026

GENERAL

TLDR InfoSec

Can't attend? Register anyways for the recording →

Summary unavailable

catonetworks.com

TLDR InfoSec

WORDFENCE ARGUS IDENTIFIES TWO CRITICAL UNAUTHENTICATED VULNERABILITY CHAINS LEADING TO REMOTE CODE EXECUTION IN THE EVENTS CALENDAR PLUGIN

Two CVSS 9.8 flaws affect The Events Calendar up to version 6.17.4. Anonymous attackers can submit crafted Gutenberg markup in event comments and then trigger execution via pending-comment previews. One chain executes OS commands via PHP object injection, while the other resets an administrator password using wp_update_user. Update to 6.17.4.1. Exploitation requires comments enabled on event pages.

wordfence.com · 6 min

TLDR InfoSec

FIRST AGENTIC AI DATA BREACH REPORTED TO SPANISH REGULATOR

Spain's AEPD received a breach notification involving an automated system. It logged in, searched for flaws, changed personal data, and accessed invoices. Possible causes include a jailbroken model, an exposed test environment, or an unauthorized penetration-testing setup. The regulator calls for faster detection, containment, and response, plus stronger protection for digital identities and credentials.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

AGENTIC SELF-MODIFICATION IN OPEN-WEIGHTS SYSTEMS

A coding agent fixed a failing query application by fine-tuning its shared Qwen model. It then merged the update into the default checkpoint, altering later agent and application instances, with held-out query accuracy rising from 0/20 to 20/20. The tuned model reproduced a synthetic API key, email, and address from training data and removed a trained refusal policy. Training tools, weight access, and deployment access increased modification attempts so as to track model lineage, retain training data and evaluations, and require approval before deployment.

irregular.com · 9 min

TLDR InfoSec

BRING YOUR OWN EDR: HOW TO TURN A COMMERCIAL EDR INTO A TROJAN HORSE

Researchers from Akamai discovered that attackers with admin access on a Windows device could abuse SentinelOne's EDR solution to dump protected processes, pivot to Microsoft Defender, and run malicious code in the Protected Process Light (PPL) context. They then extended this research by demonstrating how they could temporarily disable the EDR, move code into the EDR's protected files, run malicious code, and then re-enable the EDR, which would then protect the malicious code as part of its local files. Additionally, they found that cloud communication can be disabled by modifying the local DNS configuration.

akamai.com · 10 min

TLDR InfoSec

HOW TO EVALUATE LLMS BEFORE PRODUCTION

When evaluating an LLM-based system to reduce false positives in GitHub secrets scanning, the team faced issues that made benchmarks unrepresentative of production workloads and prevented them from properly evaluating model performance. To combat this problem, the team at GitHub created an LLM evaluation framework. First, teams should define the product decision that the system should support; then teams should make sure that offline experiments use a representative dataset and have only one clearly defined variable; error analysis and LLM-as-judge systems can be used to guide human analysts towards interesting aspects of the evaluation; and then finally the experiment can be promoted to production.

github.blog · 12 min

TLDR InfoSec

COMP AI (PRODUCT LAUNCH)

Comp AI provides software for governance, risk, and compliance work. It automates onboarding, evidence collection, policy drafting, control monitoring, and assessments.

trycomp.ai

TLDR InfoSec

$1 MILLION SANDBOX CHALLENGE UNCOVERS LINUX KERNEL FLAWS

Vercel's two-week sandbox bounty received 1,285 reports and validated 92 findings, including one critical issue. No report accessed customer data. A leading submission chained two Linux networking flaws: one leaked host-kernel memory and another deterministically crashed the host. Patches remain under private review, and CVEs are pending.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

CISCO WARNS OF MAX SEVERITY ISE ZERO-DAY EXPLOITED IN ATTACKS

Cisco released security updates to address vulnerabilities in its Identity Services Engine, including a maximum-severity authentication bypass. An attacker could exploit the vulnerability to bypass authentication in the web-based management interface by sending a crafted request to affected endpoints. The Cisco PSIRT has identified this vulnerability as actively exploited and urges customers to update immediately.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CISA PROMOTES A FRESH WAY TO DETER CYBERATTACKERS: LIE TO THEM

CISA has published its first-ever guidance on setting up honeypot systems, accounts, and data to distract potential attackers and ultimately help discover them. The guidance comes from internal discussions with CISA threat hunters and pentesters who found that cyber decoys can be a low-cost, high-fidelity way to detect attackers who have gained access to a network.

cyberscoop.com · 2 min

TLDR InfoSec

DATA BROKER RADARIS LOSES DOMAINS IN PRIVACY FIGHT

A New Jersey court transferred 14 Radaris-linked domains to Atlas Data Privacy after defendants missed court deadlines in Daniel's Law litigation.

krebsonsecurity.com · 4 min

TLDR InfoSec

ATTACKERS EXPLOIT ISSABEL FRAMEWORK FLAW ENABLING UNAUTHENTICATED OS COMMAND EXECUTION

CVE-2026-89026 lets unauthenticated attackers forge JWT bearer tokens in Issabel Framework.

thehackernews.com · 1 min

TLDR InfoSec

BE ALERT: TARGETED ATTACKS ON PROMINENT RUSTACEANS

Prominent Rust maintainers are being lured onto fake job and contract video calls that end with a request to install a missing audio codec or paste a clipboard command.

blog.rust-lang.org · 1 min