TLDR INFORMATION SECURITY 2026-01-09

SCHEDULE A DEMO →

ILLINOIS HEALTH DEPARTMENT EXPOSED OVER 700,000 RESIDENTS' PERSONAL DATA FOR YEARS

Illinois' Department of Human Services left an internal mapping site publicly accessible for more than four years, exposing data on over 700,000 people receiving state benefits. The leak revealed addresses, case numbers, demographic details for Medicaid and Medicare Savings Program recipients, and names and case information for tens of thousands of individuals receiving rehabilitation services.

ESA CALLS COPS AS CRIMS LIFT OFF 500 GB OF FILES, SAY SECURITY BLACK HOLE STILL OPEN

The European Space Agency faces a new breach after Scattered/Shiny Lapsus$ Hunters claimed to have stolen 500 GB of highly sensitive operational, spacecraft, and contractor data from ESA systems, including information on missions involving partners such as SpaceX and Airbus. The attackers say their access remains open. The ESA has referred the case for a criminal inquiry amid a history of prior security incidents dating back to 2011.

CRITICAL JSPDF FLAWS LETS HACKERS STEAL SECRETS VIA GENERATED PDFS

The popular jsPDF library is vulnerable to a local file inclusion and path traversal attack that can allow attackers to steal secrets. The flaw allows attackers to pass unsanitized paths directly to the loadFile function or any functions that call it. The vulnerability was fixed in version 4.0.0, but it may not be comprehensive on Node 20 and earlier.

DECODING THE GITHUB RECOMMENDATIONS FOR NPM MAINTAINERS

Following recent npm supply chain attacks, GitHub's hardening guidance centers on three controls: adopting Trusted Publishing Framework (OIDC-based short-lived credentials instead of long-lived tokens), enforcing 2FA for all publishing operations, and using WebAuthn/passkeys instead of TOTP for phishing-resistant authentication. npm deprecated new TOTP setups in October and disabled legacy tokens in November, requiring maintainers to use granular access tokens with expiration for CI/CD automation. Maintainers should configure trusted publisher relationships in package settings, enable 2FA across all sensitive operations, and enroll WebAuthn authenticators while maintaining repository access controls.

DO SMART PEOPLE EVER SAY THEY'RE SMART? (SMARTERTOOLS SMARTERMAIL PRE-AUTH RCE CVE-2025-52691)

A critical pre-auth remote code execution flaw (CVE-2025-52691) in SmarterTools SmarterMail, a business email and collaboration server for Windows and Linux, arises from an unauthenticated file upload endpoint that accepts attacker-controlled parameters. It includes a GUID used to construct file paths, enabling arbitrary file writes via path traversal and by crafting a multipart/form-data request with specific context and contextData values. With a malicious file, an attacker can place a web shell in the webroot and gain full remote code execution.

THE LOG RINGS DON'T LIE: HISTORICAL ENUMERATION IN PLAIN SIGHT

Logs are an essential tool for defenders to monitor for breaches and investigate incidents. However, they can also be a valuable enumeration tool for attackers. This article provides a comprehensive overview of how attackers can abuse logs for enumeration in AWS, Azure, and GCP. Security teams should treat logs with care and enforce the principle of least privilege where possible.

BLACKBIRD.AI (PRODUCT LAUNCH)

Blackbird.AI provides an AI-powered narrative intelligence platform that helps organizations detect, analyze, and respond to harmful or misleading online narratives and influence campaigns that threaten reputation, operations, and security.

PQC NETWORK SCANNER

The PQC Network Scanner is a quantum-focused network assessment tool that scans TLS/SSL certificates across environments to identify systems vulnerable to future quantum attacks.

OGHIDRA

OGhidra bridges LLMs via Ollama with Ghidra to enable AI-driven binary analysis through natural language.

GO.SUM IS NOT A LOCKFILE

Go's go.sum file is not a lockfile and has no effect on version resolution—it's purely a local cache for the Go Checksum Database to ensure cryptographic integrity. Developers should use go.mod for dependency analysis, which, since Go 1.17, lists all transitive dependencies with exact versions and functions as both a manifest and lockfile. This design eliminates diamond dependency conflicts and prevents automatic upgrades to potentially compromised dependency versions.

KERNEL BUGS HIDE FOR 2 YEARS ON AVERAGE. SOME HIDE FOR 20

Analysis of 125,183 Linux kernel bugs with Fixes: tags revealed an average bug lifetime of 2.1 years, with race conditions averaging 5.1 years, and the longest-lived bug persisted for 20.7 years. Detection rates improved dramatically, from 0% bugs found within one year in 2010 to 69% in 2022, driven by tools such as Syzkaller and kernel sanitizers. The VulnBERT model achieved 92.2% recall and a 1.2% false-positive rate by combining CodeBERT embeddings with 51 handcrafted features targeting patterns such as unbalanced refcounts and missing NULL checks.

CHATGPT FALLS TO NEW DATA-PILFERING ATTACK AS A VICIOUS CYCLE IN AI CONTINUES

Security researchers at Radware show how a new “ZombieAgent” attack revives a previously blocked ChatGPT data‑exfiltration technique by tweaking prompts to bypass URL restrictions and leak information character by character. Indirect prompt injection and weak separation between user instructions and embedded content keep LLM agents vulnerable, forcing vendors into an endless patch-and-bypass cycle rather than a fundamental fix.

WHY WE'RE TAKING LEGAL ACTION AGAINST SERPAPI'S UNLAWFUL SCRAPING

Google filed a lawsuit against SerpApi for circumventing security measures through bot networks, cloaking techniques, and fake crawler identities to scrape and resell copyrighted content from search results.

MAJOR DATA BREACH HITS COMPANY OPERATING 150 GAS STATIONS IN THE US

Gulshan Management Services, operator of Handi Plus and Handi Stop gas stations, disclosed a September 2025 breach exposing SSNs, financial data, and government IDs of 377,000+ individuals.

COOLIFY DISCLOSES 11 CRITICAL FLAWS ENABLING FULL SERVER COMPROMISE ON SELF-HOSTED INSTANCES

Cybersecurity researchers reveal 11 critical vulnerabilities in Coolify, a popular self‑hosting platform, that enable authenticated low‑privileged users to achieve root command execution, escape containers, and even obtain the server's root SSH key, potentially compromising entire infrastructures.