The Daily Index — Wednesday, September 23, 2026

GENERAL

TLDR InfoSec

ACCESS THE FULL REPORT

Summary unavailable

flashpoint.io

TLDR InfoSec

SHINYHUNTERS HACKS CLOP LEAK SITE, THREATENS TO EXTORT RANSOMWARE GANG

The ShinyHunters ransomware gang hacked the Clop ransomware gang's data leak site on Tor, defaced it, and claimed to have stolen server data and private keys for its onion service. The ShinyHunters claim to have exploited an unauthenticated file upload vulnerability in Grav CMS to breach the site. This appears to be the latest escalation in an ongoing feud between the two ransomware gangs.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

A SCENARIO TO EVALUATE YOUR AGENTIC SOC

A SOC investigation loop requires assembling a full attack chain from various different signals that may look benign or unrelated, which traditional, deterministic playbooks may miss. The authors built a set of scenarios to evaluate agentic SOC's investigative ability and built their own harness (called Tengu). Their scenario involves a GitHub workflow vulnerability that leads to full Kubernetes cluster compromise, which then is escalated to full AWS account compromise. Of the models tested on a naive prompt, only Opus 5 managed to identify the alert as a true positive without the Tengu harness

unsecure.sh · 20 min

TLDR InfoSec

INFOSTEALERS HAVE FOUND A NEW TARGET: YOUR AI AGENT

Researchers from Gen have observed multiple new infostealers that harvest credentials, context, and local data from AI agents. Users and security teams should inventory what gets cached locally, keep secrets out of prompts and history, limit what connectors can do, and continue securing endpoints. Agent providers should also share the burden by providing more secure default behaviors.

gendigital.com · 10 min

TLDR InfoSec

THE CLOSED QUORUM: INSIDE THE FIRST REPORTED AUTONOMOUS AI C2 IMPLANT

CLOSEDQUORUM, a Go-based Windows implant, uses DeepSeek, Qwen, Mistral, and Gemini as its C2. Every 5 to 15 minutes, the models vote through a constrained JSON schema on whether to steal LSASS, browser, and crypto wallet credentials, inject shellcode, or persist via Run keys, scheduled tasks, and WMI. Talos hasn't seen it in the wild, and the public build is an inert template, but it points to a credentials-as-a-service model where each operator gets a custom build and never needs to be online. Its dependence on commercial APIs brings refusals, rate limits, and a deterministic DeepSeek tiebreak, so defenders should correlate multi-provider LLM traffic from unexpected executables with LSASS access, suspended-process injection, WMI persistence, and Discord webhook exfil instead of blocking domains.

blog.talosintelligence.com · 9 min

TLDR InfoSec

packages.

Summary unavailable

advertise.tldr.tech

TLDR InfoSec

HELMGUARD (PRODUCT LAUNCH)

HelmGuard provides governance, risk, compliance, and security software. It gathers evidence from source systems, documents, and unstructured data, then automates risk assessments, assurance tasks, and control-gap reviews.

helmguard.ai

TLDR InfoSec

ANTHROPIC-LINKED CVES PILE UP, ATTACKERS MOSTLY SHRUG

VulnCheck's Patrick Garrity tracked 225 CVEs tied to Anthropic's Project Glasswing, which gives partners access to the Claude Mythos Preview model for bug-hunting. Only one, a critical SQL injection in Ghost (CVE-2026-26980), has been exploited in the wild. Garrity says that historically 1-2% of vulnerabilities are weaponized, so this rate isn't unusual. AI models are uncovering more bugs, driving recent record patch counts from Microsoft, Apple, and Palo Alto Networks, but fixing bugs remains weak: 1Password found that Opus 4.8 and ChatGPT-5.5 fully resolved vulnerabilities in only 26% of 6,080 patches tested, and Veracode measured a 56% average security pass rate across 100+ models.

theregister.com · 2 min

TLDR InfoSec

GOOGLE HIT WITH $463 MILLION FINE FOR EU LOCATION DATA RULE BREACH

Ireland's Data Protection Commission fined Google 403 million euros for GDPR breaches involving location data. The probe covered Web & App Activity, Location History, and Android's Location Accuracy feature from 2018 through February 2020. Regulators found the processing unlawful, unfair, or opaque, even though Google said it changed its policies and released new location-management tools in 2019.

abcnews.com · 2 min

TLDR InfoSec

SHINYHUNTERS CLAIMS FBI HACK, DATA THEFT IN PEOPLESOFT ZERO-DAY BREACH

The ShinyHunters claim to have breached the FBI's job site and networks using a zero-day in Oracle PeopleSoft. The ransomware gang claims to have stolen 2-3TB of data, including PII and PHI of current and former FBI employees and job seekers, as well as other internal records. The hackers said they carried out the attack in retaliation for an FBI FLASH report on ShinyHunters.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

BREVO SUPPLY CHAIN ATTACK INJECTS MALWARE INTO 100,000 WEBSITES

Attackers exploited Brevo SAML SSO handling, accessed 138 accounts, and later used a stolen Cloudflare API key.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

CRITICAL CHECK POINT MANAGEMENT FLAW LETS UNAUTHENTICATED ATTACKERS RUN CODE AS ROOT

Check Point patched CVE-2026-91843, a CVSS 9.8 login stack overflow.

thehackernews.com · 2 min

TLDR InfoSec

GLIBC LD.SO TOCTOU LETS LOCAL USERS HIJACK $ORIGIN ON SETUID BINARIES

A race in glibc's ld.so (CVE-2026-86805, versions 2.14 through 2.44) lets local users hardlink a setuid binary whose $ORIGIN RPATH uses ".." traversal and swap in a symlink to load attacker code with elevated privileges.

freenode.net · 1 min