The Daily Index — Tuesday, October 13, 2026

GENERAL

TLDR InfoSec

SAVE YOUR SEAT →

Summary unavailable

flashpoint.io

TLDR InfoSec

IRHYTHM DATA BREACH IMPACTS AT LEAST 360,000 PEOPLE

Hackers accessed third-party-hosted iRhythm applications from June 3 to June 8 and stole patient names, addresses, email addresses, birth dates, phone numbers, account details, device serial numbers, insurance numbers, and service dates. State filings cover at least 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. The attackers demanded ransom on June 9. iRhythm says there is no evidence of identity theft and no impact to medical devices or operations.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

A STORY OF WIFI SECRETS, UART LOCKDOWNS, AND A DAMAGED FLASH MEMORY CHIP

Researchers extracted firmware from an Eufy HomeBase 2 by desoldering its Winbond flash chip and reading it over SPI. They recovered most of firmware 3.4.2.2h, losing a 64 KB block during chip removal. Reverse engineering showed the OCEAN_ management Wi-Fi password uses HMAC-SHA256 over an I2C-read value, keyed by the device serial number, then URL-safe base64 encoding. The UART lockdown came from a login script checking an NVRAM debug flag. They patched the intact recovery image to force a root shell, reflashed it, then staged a temporary filesystem to run the main home_security binary for dynamic analysis.

adepts.of0x.cc · 15 min

TLDR InfoSec

HANDS OFF THE KEYBOARD: HOW AI AGENTS RUN REAL INTRUSIONS

Breachcache recovered 75 transcripts from servers used to run autonomous AI agent intrusions. The agents performed reconnaissance, selected exploits, gained command execution on 23 hosts, and, in one case, used SSRF to steal cloud instance credentials and launch a root instance. Other runs exploited SQL injection, rooted an Open WebUI service through CVE-2026-0766, and exfiltrated unmasked card data and crypto wallet keys. Operators used Cairn for coordination, rotated proxies and Tor for evasion, and audited source code to find payment-callback forgery and account-takeover flaws in AI gateway software.

breachcache.com · 20 min

TLDR InfoSec

HADRIAN (PRODUCT LAUNCH)

Hadrian is an offensive security platform that maps external attack surfaces, validates exploitable exposures, runs on-demand penetration testing, prioritizes risks, and verifies remediation.

hadrian.io

TLDR InfoSec

NIPPON COLUMBIA MALWARE INCIDENT EXPOSES 8.6M KARAOKE FAN RECORDS

Daiichi Kosho, Japan's largest karaoke maker, disclosed that a breach at its contractor Nippon Columbia exposed the data of over 8.6M customers and almost 100K employees. The malware infection was discovered on an employee's computer and it was subsequently isolated. The exposed data may include full names, genders, dates of birth, email addresses, and phone numbers.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

THREE OAUTH ACCOUNT TAKEOVERS, ONE BUG: AUTO-LINKING BY EMAIL

Attackers took over accounts in Pingvin Share X, Better Auth, and AshAuthentication by abusing auto-linking, where an OAuth sign-in is attached to whichever existing account shares its email address. Each library skipped a different check: Pingvin ignored email_verified, Better Auth never verified the local account's email, and AshAuthentication never compared the two emails, though the writeup comes from WorkOS, which sells a competing auth product. Developers should look up identities by issuer and subject ID first, require verified emails on both sides, and make users prove they own the existing account, including MFA, before any link happens.

workos.com · 7 min

TLDR InfoSec

THE PROMPT IS NOT THE PERMISSION: SECURING THE AGENTIC SDLC

Telling a coding agent what not to do does not stop it, because a malicious line in an issue, changelog, or config file can steer it into reading secrets or leaking private data while still producing a clean pull request. Real limits have to live outside the model, through isolated workspaces, task-scoped identities, short-lived credentials, and network policy. Test those limits directly, since an agent refusing a planted instruction proves nothing about whether the platform would have blocked the action.

vinny.dev · 12 min

TLDR InfoSec

you can focus on higher-value security tasks. Meet Robin

Summary unavailable

atera.com

TLDR InfoSec

NORWAY FINES MICROSOFT AD FIRM $9.6 MILLION OVER GRINDR DATA SHARING

Norway's data protection authority issued its largest fine ever, $9.6M, against Microsoft-owned Xandr for exposing Grindr users' sexual orientation data to thousands of advertisers through real-time ad auctions from 2018 to 2020 without valid consent.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

LEDGER SAYS ALL CONFIRMED CASES TRACE TO RESELLER CRYPTOBILIS, GIVES NO LOSS TOTAL

Every confirmed Ledger wallet drain traced back to Southeast Asian reseller CryptoBilis, though Ledger gave no loss total, while on-chain trackers estimated $93.2M to $103.4M stolen and Tether froze only about $10M before the attacker laundered funds through Tornado Cash and Zcash.

unchainedcrypto.com · 3 min

TLDR InfoSec

ANTHROPIC SAYS NEW SAFEGUARDS SHARPLY REDUCE AI DISTILLATION ATTACKS

Anthropic said new limits on access to Claude's reasoning cut data harvested by distillation attacks by 90% to 99%, after it banned tens of thousands of accounts and named Chinese startup Z.ai as one company that tried to copy Claude while building its GLM-5.3 model.

links.tldrnewsletter.com · 2 min