The Daily Index — Tuesday, September 22, 2026

GENERAL

TLDR InfoSec

GET THE GUIDE

Summary unavailable

humansecurity.com

TLDR InfoSec

WORDPRESS CLICK2SHELL FLAW ENABLES RCE AFTER ONE ADMIN CLICK

Click2Shell exploited an unsanitized theme slug passed into WordPress's admin panel jQuery selector, letting an attacker silently trigger theme installation using the logged-in administrator's own session token. When chained with a missing nonce/capability check in the Mobile Repair Zone 2.5.4 theme's AJAX handler, the flaw escalated to full RCE without the attacker needing any WordPress account. No CVE had been assigned at disclosure. Defenders should patch to WordPress 7.1.1 (or backports 7.0.5, 6.9.8, and 6.8.9) and set DISALLOW_FILE_MODS to block the installation stage entirely.

cyberinsider.com · 3 min

TLDR InfoSec

UANIA OS: AUTHENTICATED REMOTE CODE EXECUTION

The UaniaBOX admin panel gives no shell, only a web GUI. A researcher found that the packet capture download function let him swap the file path parameter to read /etc/passwd, then traced backend calls to an exposed OpenWrt UBUS JSON-RPC endpoint. ACLs blocked most writes except one: /etc/firewall.user, a root-run shell script triggered on firewall reload, where it allowed writing a command there and triggering a reload via the GUI executed code as root, confirmed by reading back uid=0. Affected versions are UaniaOS 2.1 through 3.0.0. It was fixed in 3.0.1. Vendor UANIA reproduced the bug, attributed it to excessive ACL permissions in their OpenWrt customization feeds, and patched it, though the MITRE CVE filing stalled for months due to a broken submission form.

rainpwn.blog · 6 min

TLDR InfoSec

WINDOWS EXPLOITATION TECHNIQUES: DANGLING COM OBJECT REGISTRATIONS

A Windows COM class stayed registered to a missing DLL in the user-writable ProgramData folder, letting any user plant code for a SYSTEM process to load (CVE-2026-66804, an incomplete fix for "Dark Elevator"). The exploit sent a custom-marshaled object pointing to the dangling CLSID to the Shell Create Object Handler, a SYSTEM COM server that ordinary users can start via a scheduled task and that allows custom marshaling. Defenders should patch, audit InProcServer32 registrations for DLLs that don't resolve in writable paths, and make sure privileged COM servers set EOAC_NO_CUSTOM_MARSHAL or the strong unmarshaling policy.

projectzero.google · 7 min

TLDR InfoSec

TIGERBYTE CYBER (PRODUCT LAUNCH)

TigerByte Cyber's Cyber Protection Suite hardens legacy and edge devices with data validation, packet inspection, network segmentation, and post-quantum encryption. It targets aircraft, drones, satellites, vehicles, and other mission-critical systems.

tigerbytecyber.us

TLDR InfoSec

HOW GOOGLE INFILTRATED A NOTORIOUS HACKING GANG WITH AN UNDERCOVER ANALYST

Google placed researcher Austin Larsen inside TeamPCP during its hacking campaign. He accessed a server holding stolen usernames, passwords, and access tokens. Google warned affected victims and disrupted credential abuse, and Larsen linked an alleged member to a Gmail account and Google Drive backups. Google shared evidence with the FBI, and the Australian police arrested the suspect a month later.

firstpost.com · 2 min

TLDR InfoSec

GEMINI HACKED THREE COMPANIES IN FIRST KNOWN BREAKOUT BY GOOGLE'S AI

During a May security evaluation, Google's Gemini accessed three external websites after finding public information and trying credentials. One access came through password guessing. Two used credentials exposed in a public repository. Google said Gemini stopped in each case. Irregular notified the affected organizations and said it fixed its testing-process issues weeks later.

edition.cnn.com · 1 min

TLDR InfoSec

NORTH KOREAN WATERPLUM HACKERS INFECTED 30,000 DEVICES WORLDWIDE

WaterPlum (aka Contagious Interview) compromised 30,000+ devices across 100+ countries between December 2025 and July 2026, draining $10.7M from over 7,000 cryptocurrency wallets. A joint US, Japanese, Australian, and German advisory attributed the campaign to North Korea's 313 General Bureau and five malware families (BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle) delivered through fake technical interviews on recruiting platforms. North Korean IT workers later reused identity documents stolen from victims to fraudulently obtain jobs at Western companies.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

Watch the video.

Summary unavailable

brighttalk.com

TLDR InfoSec

LONDON PROPERTY MANAGER BREACH MAY HAVE EXPOSED BANK DETAILS AND LOCKBOX CODES

City Relay said attackers accessed its Metabase Cloud instance twice and extracted customer data.

theregister.com · 3 min

TLDR InfoSec

MALICIOUS NPM PACKAGES EVADE INSTALL-SCRIPT DEFENSES AT RUNTIME

The 'indexed-btree' npm package, which impersonates 'sorted-btree' and pulls 2 million weekly downloads, hid its loader in the BTree.prototype.set() method to bypass npm v12's install-script approvals.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

INTEL SUSPENDS BUG BOUNTY PROGRAM WITH REWARDS UP TO $100,000

Intel quietly suspended its Intigriti bug bounty program, which paid up to $100,000 per finding, replacing it with a no-reward vulnerability disclosure program and offering no public explanation for the change.

videocardz.com · 1 min