TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-01-12

6 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

CHINA-LINKED HACKERS EXPLOIT VMWARE ESXI ZERO-DAYS TO ESCAPE VIRTUAL MACHINES

Huntress observed Chinese-speaking threat actors exploiting three VMware ESXi zero-days (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) to escape virtual machine isolation and gain full hypervisor control. Evidence suggests the exploit toolkit was developed as early as February 2024, over a year before Broadcom's March 2025 disclosure. The multi-stage attack chain used a compromised SonicWall VPN for initial access and deployed the VSOCKpuppet backdoor, which communicates over VSOCK to bypass traditional network monitoring entirely. Organizations should prioritize patching these vulnerabilities and monitor for unusual VMCI/VSOCK activity between guest VMs and hypervisors.

thehackernews.com4 min read

BREACHFORUMS HACKING FORUM DATABASE LEAKED, EXPOSING 324K ACCOUNTS

The latest version of the infamous BreachForums suffered a data breach that leaked a database of user accounts. The breached data includes display names, registration dates, IP addresses, and other internal information. Many of the breached users' IPs route to loop back, but over 70k records contain public IPs.

bleepingcomputer.com2 min read

INSTAGRAM DATA LEAK EXPOSES SENSITIVE INFO OF 17.5M ACCOUNTS

Malwarebytes raised concerns about a trove of Instagram user information being sold on the dark web. The breached data includes usernames, emails, phone numbers, and partial location data. Instagram has stated that there was no data breach, but rather an issue that allowed external parties to send unrequested password reset emails.

cybersecuritynews.com2 min read

03STRATEGIES & TACTICS

ORM LEAKING MORE THAN YOU JOINED FOR

ORM Leak vulnerabilities extend beyond susceptible ORMs such as Django and Prisma to any application that implements robust filtering capabilities. This article details practical examples, including Harbor CVE-2025-30086 (Beego ORM) and authentication bypasses via Prisma operator injection via type coercion, and discusses multiple techniques for bypassing naive protections, including exploiting Beego's broken expression parsing, where non-relational fields in filter expressions are overwritten by subsequent fields. Semgrep detection rules for Django, Prisma, Beego, and Entity Framework ORMs have been published to help identify these commonly overlooked vulnerabilities.

elttam.com15 min read

TWO CVES, ZERO EGO: A MAILPIT STORY

Mailpit is a lightweight email testing tool used in development that recently had two notable security issues uncovered: a server-side request forgery (SSRF) and a cross-site WebSocket hijacking (CSWSH) flaw. The SSRF bug allowed attackers to abuse a proxy endpoint to access internal services such as cloud metadata, while the WebSocket issue allowed any website to connect and stream all captured emails without authentication. The maintainer quickly fixed both issues in new releases and coordinated CVEs, showing how respectful communication, GitHub Security Advisories, and low-ego collaboration between researchers and developers lead to fast, effective vulnerability remediation.

rosecurify.com4 min read

ATTACKERS LOVE YOUR GITHUB ACTIONS TOO

GitHub ranks as the second most used CI/CD tool, but it also exposes a large attack surface to attackers. GitHub Actions can unintentionally expose secrets or overprovision tokens. Actions are vulnerable to supply chain compromise via poisoned dependencies and injection attacks.

orca.security8 min read

04LAUNCHES & TOOLS

TAILSNITCH

Tailsnitch is a security auditing tool for Tailscale configurations that scans tailnets for 50+ misconfigurations, overly permissive access controls, and security best practice violations across seven categories, including ACLs, authentication keys, and network exposure. The tool supports severity filtering, interactive remediation mode, JSON export for CI/CD integration, and SOC 2 evidence generation with Common Criteria control mappings. Checks range from critical issues like default allow-all policies and overly broad tagOwners to informational items covering logging and DNS settings.

github.comGitHub repository

GIXY-NEXT

Gixy-Next (Gixy) is an open-source NGINX configuration security scanner and hardening tool that statically analyzes nginx.conf files to detect security misconfigurations, hardening gaps, and common performance pitfalls before they reach production. It is an actively maintained fork of Yandex's Gixy.

github.comGitHub repository

BINYARS

BinYars is a Binary Ninja plugin that integrates YARA-X into Binary Ninja.

github.comGitHub repository

05MISCELLANEOUS

MUDDYWATER LAUNCHES RUSTYWATER RAT VIA SPEAR-PHISHING ACROSS MIDDLE EAST SECTORS

Iranian threat actor MuddyWater has been attributed to spear-phishing campaigns targeting diplomatic, maritime, financial, and telecom entities in the Middle East using a new Rust-based implant called RustyWater (also known as Archer RAT/RUSTRIC). The malware, delivered via malicious Word documents with VBA macros, establishes registry persistence and supports asynchronous C2 communication for file operations and command execution. This marks MuddyWater's continued evolution away from PowerShell and VBS loaders toward more structured, modular RAT capabilities.

thehackernews.com2 min read

EUROPOL ARRESTS 34 BLACK AXE MEMBERS IN SPAIN OVER €5.9M FRAUD AND ORGANIZED CRIME

Europol and Spanish police have dismantled a major Black Axe cell in Spain, arresting 34 suspects across Seville, Madrid, Málaga, and Barcelona for cyber-enabled fraud and violent organized crime. Authorities link the Nigerian-origin syndicate to scams like business email compromise and romance fraud, with losses over €5.93 million, and report cash and bank account seizures alongside prior global crackdowns on the group.

thehackernews.com3 min read

CYBERSECURITY CHANGES I EXPECT IN 2026

The primary cybersecurity question of 2026 will be whether an attacker's or defender's AI is more effective. Agentic security will encourage teams to build products rather than buy them, devalue junior employees, and lead to workplace upheaval. AI will also improve the efficacy of common security program weak points, such as secure code training and asset management.

danielmiessler.com10 min read