The Daily Index — Monday, September 21, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

GYAZO BREACH EXPOSES 23.62 MILLION USER RECORDS AND 490 MILLION IMAGE METADATA RECORDS

Gyazo's upload server flaw let an attacker run commands and access its database. Exposed data includes 23.62 million user records, password hashes, session IDs, integration tokens, and 490 million image metadata records. Leaked image IDs may expose linked captures. Helpfeel fixed the flaw, blocked access routes, and urged password changes.

thehackernews.com · 3 min

TLDR InfoSec

GOOGLE PIXEL PHONES PWNED IN ZERO-CLICK ATTACKS

Google has fixed CVE-2026-58704, an actively exploited Pixel modem authorization flaw. Attackers can bypass permission checks and escalate privileges without user interaction. CISA added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by September 19. Google disclosed limited, targeted exploitation but provided no attack details and asked users to update supported Pixel devices immediately.

theregister.com · 2 min

TLDR InfoSec

GLM-5.3 DELIVERS OPUS 4.8-LEVEL PERFORMANCE AT A FRACTION OF THE COST

Semgrep benchmarked the new Grok models and GLM-5.3 on their standard IDOR vulnerability-finding benchmark. They found that Grok 4.6 Exacto roughly matched Opus 4.7's F1 score at less than a third of the cost. GLM-5.3 was able to compete with Opus 4.8 at one seventh of the cost.

semgrep.dev · 4 min

TLDR InfoSec

REVERSE ENGINEERING MALWAREBYTES BROWSER GUARD

After the author's legitimate site got flagged as a scam by Malwarebytes Browser Guard, they took a deep dive into the source code to identify what caused it. This post walks through the several layers Browser Guard uses, including bloom filters, heuristic rules, a malware URL database, a download file classifier, specialized rules for specific attacks like ClickFix, and remote false-positive checking using Hubble. The bigger issue, the author noted, is that the extension ships with a debug interface that can be used to disable heuristics.

msil.re · 36 min

TLDR InfoSec

HOW TO BUILD AN OT SECURITY OPERATING MODEL

An implementation guide breaks an OT security program into six components, beginning with asset discovery and process context mapping that tie every device to the operational process it supports. Availability and process safety outrank confidentiality here, so access boundaries, monitoring, incident response, and recovery each require joint sign-off from operations before deployment. Ownership belongs to a cross-functional executive such as a CISO or VP of Operations, with NERC CIP and NIST SP 800-82 treated as checkpoints rather than as the program design itself.

scworld.com · 10 min

TLDR InfoSec

threat landscape are all pointing to. Read the blog

Summary unavailable

links.tldrnewsletter.com

TLDR InfoSec

HACKERS CRACKED A FLOCK CAMERA. HERE IS WHAT WAS INSIDE.

A removed Flock camera exposed 1.6 million images and records of 50,200 vehicles over 21 days. Unencrypted Android partitions stored a key for footage encryption, and the device ran about 20 custom apps and captured bursts of vehicle images. Uploaded records could be searched by more than 2,000 agencies, including out-of-state users.

gadgetreview.com · 3 min

TLDR InfoSec

RESEARCHERS USED CLAUDE TO HACK OPENAI

Hacktron AI researchers used Anthropic's security tool to exploit an OpenAI community-forum configuration flaw. They obtained internal sign-ons, accessed an employee's ChatGPT account, and reached GitHub-linked code. OpenAI paid the team $6,500 through its bug bounty program after disclosure, and OpenAI said it fixed the reported issues.

arstechnica.com · 2 min

TLDR InfoSec

OUR FRAMEWORK FOR REPORTING MODEL MISALIGNMENT

OpenAI released a disclosure process and six incident reports. Cases include 27 summaries containing prompt injections, use of an exposed API key, fabricated county data, unauthorized file uploads, repository writes, and public file-sharing. Reports can be delayed when third parties or undisclosed vulnerabilities require investigation and notification.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

INTERNATIONAL METEOR ORGANIZATION SAYS CYBERATTACK DEALT ‘CRITICAL BLOW' TO WEBSITE

A cyberattack took much of the International Meteor Organization's aging web infrastructure offline.

therecord.media · 1 min

TLDR InfoSec

ZERO-CLICK RCE VULNERABILITY HIT FOUR MAJOR AI CODING AGENTS, TWO REMAIN UNPATCHED

Plugin4Shell bypasses SHA pinning in Claude Code, Codex, GitHub Copilot, and Gemini CLI plugins.

helpnetsecurity.com · 3 min

TLDR InfoSec

CRITICAL PRE-AUTH RCE IN ORKES CONDUCTOR WORKFLOW PLATFORM EXPLOITED IN THE WILD

Attackers are actively exploiting a critical pre-auth RCE (CVE-2026-58138) in Orkes Conductor by escaping unsandboxed GraalVM evaluators to execute arbitrary OS commands, requiring an immediate upgrade to version 3.30.2.

thehackernews.com · 2 min