The Daily Index — Friday, October 23, 2026

GENERAL

TLDR InfoSec

Test-drive your cyber readiness

Summary unavailable

semperis.com

TLDR InfoSec

AWS KEY QUARANTINE IS NOT REVOCATION

When AWS detects leaked keys, it will apply a quarantine policy to the IAM user associated with the key that denies certain sensitive actions. Truffle Security audited the quarantine policy and found significant gaps such as the ability to read secrets from Secrets Manager or parameters from Parameter Store, the ability to run a command on a running EC2 instance, and the ability to download S3 objects via GetObjectVersion. Truffle Security noted that beyond quarantine, revocation remains a major gap, with many of the keys they tested exposed for years.

trufflesecurity.com · 6 min

TLDR InfoSec

HOW ABLITERATED MODELS CAN GET YOU PWNED

To test the process of creating a backdoored model, ProjectDiscovery researchers fine-tuned Qwen2.5-7B to exfiltrate a .env file when it encounters a trigger phrase. The researchers achieved this with a rented GPU and a small dataset containing 20% poisoned prompts. Backdoored models are incredibly difficult to detect, so teams should use strong behavioral filters and avoid downloading models from untrusted sources.

projectdiscovery.io · 5 min

TLDR InfoSec

THE CURRENT LANDSCAPE OF OAUTH ATTACKS

Attackers have shifted to stealing OAuth access and refresh tokens, bypassing MFA and surviving password resets, using device code phishing, consent screens for impersonated or vaguely named apps, and redirect_uri abuse that sends victims from real IdP domains to attacker pages. Unit 42 found PhaaS kits reusing the same anti-bot and Cloudflare RUM tokens across campaigns, along with AES-GCM payloads decrypted at runtime on Cloudflare Workers and LLM-generated lures, though the report gives no victim counts. Defenders should replace end-user consent with admin approval workflows, audit registered redirect_uri values for unverified domains, and flag device codes pasted from untrusted sources.

unit42.paloaltonetworks.com · 16 min

TLDR InfoSec

user limits.

Summary unavailable

workbrew.com

TLDR InfoSec

INDUREX (PRODUCT LAUNCH)

Indurex provides SafeGuard AI, security software for industrial cyber-physical systems. It analyzes control, safety, alarm, process-history, and IT-security data to flag anomalies and changes to engineering configurations, protection settings, and safety functions.

indurex.ai

TLDR InfoSec

ANTARES: A SECURITY ANALYST THAT NEVER LEAVES YOUR LAPTOP – SECURITY LOOP SERIES, PART 1

Antares-1B is a Cisco model, post-trained from IBM Granite 4.0 1B, that locates vulnerable files offline by running up to 15 read-only sandboxed shell commands against a repo given only a CWE description. Cisco's own benchmark placed it fourth in file F1 on the 500-repo VLoc Bench, ahead of Gemini 3 Pro and with the best recall of any system tested, and the author's Apple M1 run reproduced about 80% of that score at roughly a minute per repo. Results export as SARIF 2.1.0 for CI gating, though noisy shortlists and a steep accuracy drop on repos beyond a few megabytes make it a triage aid rather than a detector.

blogs.cisco.com · 10 min

TLDR InfoSec

TECH AND SECURITY COMPANIES RESPOND TO PHP2SHELL VULNERABILITIES

PHP2Shell, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution. PHP released fixes on October 21, after exploitation attempts began on October 17. Cisco, AWS, Google Cloud, Ubuntu, Debian, Palo Alto Networks, Sophos, and others issued patches, mitigations, or detection rules. CISA, UK NCSC, CERT-EU, and other agencies urge immediate updates, especially for internet-facing systems. Some European government, school, and hospital sites were taken offline.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

TIDB BREACH EXPOSES FLAWED CLOUD SECURITY ASSUMPTIONS

PingCAP disclosed that attackers used stolen service-account credentials to access TiDB systems from September 9 to October 7, copying data and source code. FulcrumSec claims it also obtained customer metadata, API keys, Jira tickets, SQL histories, and a four-year TiDB Cloud connection log. Customer databases were reportedly untouched, but query logs and diagnostics can contain connection strings, secrets, and sensitive records.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

STATE OF POST-QUANTUM CRYPTOGRAPHY IMPLEMENTATIONS

Quarkslab's differential fuzzer DeltAFLy found that seven of ten tested libraries, including liboqs, AWS-LC, and libcrux, accepted malformed ML-DSA private keys with out-of-range coefficients that can bias rejection sampling and leak secret key material, while only OpenSSL, BoringSSL, and SymCrypt rejected them. The same campaign uncovered an OID collision bug in RustCrypto's XMSS code that made imported XMSSMT public keys fail verification. The post also surveyed PQC support across more than 20 open-source libraries, finding ML-KEM and ML-DSA nearly universal while HQC, Classic McEliece, and X-Wing remain sparsely implemented.

blog.quarkslab.com · 17 min

TLDR InfoSec

DEVELOPER PLATFORM RAILWAY URGES ‘ALL USERS' TO REVOKE SECRET KEYS AFTER CYBERATTACK

Railway says attackers accessed encrypted environment variables and decrypted some customer secrets.

techcrunch.com · 2 min

TLDR InfoSec

MICROSOFT ENTRA ID ENDING NATIVE SMS AUTHENTICATION, PUSHING USERS TO PASSKEYS

Microsoft will retire its built-in SMS and voice MFA in Entra ID on February 1, 2027 (July 1, 2027 for Global Administrators and external users), forcing SMS-only users into a blocking passkey registration at sign-in unless their organization purchases a third-party telephony provider through the Microsoft Security Store.

neowin.net · 2 min

TLDR InfoSec

“IGNORE THE SLOP”

curl maintainer Daniel Stenberg said every one of the hundreds of vulnerability reports curl received in recent months involved AI, but hallucinated slop had largely disappeared since spring 2026, leaving maintainers with a harder problem of high-volume, accurate, overly wordy reports they cannot ignore.

daniel.haxx.se · 3 min