TLDR INFORMATION SECURITY 2026-02-26

Watch now

CRITICAL VULNERABILITY IN META MANUS AI AGENT ENABLES ZERO-CLICK INDIRECT PROMPT INJECTION

SilentBridge is a family of CVSS 9.8 zero-click indirect prompt injection vulnerabilities in Meta's Manus AI agent that allowed hidden instructions in web pages, search results, and documents to hijack high-privilege agent capabilities, including Gmail access, code execution, and root-level container control. Researchers demonstrated full exploit chains in which benign actions, such as “summarize this page,” triggered Gmail data exfiltration, the establishment of a reverse shell with passwordless sudo escalation, public exposure of internal code-server tooling, and cross-tenant media access via unauthenticated CDN paths. Manus deployed mitigations following responsible disclosure, but the findings highlight a systemic trust-boundary failure affecting any agentic AI platform that allows untrusted content to influence privileged tool invocation without isolation or user consent.

CARGURUS DATA BREACH AFFECTS 12.5 MILLION ACCOUNTS

Automotive marketplace CarGurus has confirmed a security incident in which 12.5 million user accounts were exposed, including names, email addresses, phone numbers, physical addresses, financial prequalification data, and some dealer information. The researchers attributed the hack to the ShinyHunters group, known for high‑impact social engineering attacks against major enterprises and universities.

WYNN RESORTS TAKES ATTACKER'S WORD FOR IT THAT STOLEN STAFF DATA WAS DELETED

Wynn Resorts confirms ShinyHunters stole extensive employee data, including personal and HR details, after exploiting Oracle PeopleSoft and valid credentials since 2025. The company says the crooks claim to have deleted the data and offers staff credit monitoring. Still, experts stress ransomware crews rarely erase stolen records and view such “deletion” promises as indicators of a completed extortion deal.

NEW MALICIOUS NPM PACKAGE “AMBAR-SRC” TARGETS DEVELOPERS WITH OPEN SOURCE MALWARE

The malicious npm package “ambar-src” accumulated ~50,000 downloads in just three days by typosquatting the popular “ember-source” package and abusing npm's preinstall script hook to execute code without any explicit import. The package deployed OS-specific open-source malware payloads, including encrypted shellcode on Windows, a Golang-based reverse SSH shell on Linux, and the Apfell/MythicAgents payload on macOS, all communicating via Yandex Cloud functions for C2 evasion. Organizations should audit dependencies for this package, treat any system where it was installed as fully compromised, and rotate all secrets from a separate machine.

LARGE-SCALE ONLINE DEANONYMIZATION WITH LLMS

Modern LLM agents can deanonymize users at scale by linking pseudonymous posts to real-world identities across platforms like Hacker News, Reddit, and LinkedIn. Using proxy tasks such as cross-platform account matching and splitting single accounts into multiple identities shows that search-plus-reasoning agents can re-identify users with high precision, and that performance degrades slowly even as candidate pools reach tens of thousands, implying platform-scale feasibility.

JA4 FINGERPRINTING AGAINST AI SCRAPERS: A PRACTICAL GUIDE

JA4 fingerprinting can be incredibly effective for detecting AI scrapers, as modifying the fingerprint requires recompiling the full TLS stack, unlike other methods, such as behavioral detection, that newer AI agents can mimic. JA4 fingerprints for the ClientHello and HTTP Headers (JA4H) can be combined with traditional systems to build a defense-in-depth detection system, which can then forward logs to a SIEM. This post includes code samples for the detection logic as well as fingerprints for several common libraries and tools.

ENVEIL

enveil is a Rust CLI tool that prevents AI coding assistants from reading plaintext secrets by replacing .env values with encrypted ev:// references backed by a local AES-256-GCM store. Secrets are decrypted in memory using an Argon2id-derived key and injected directly into subprocess environments at launch, ensuring plaintext values never touch disk. The tool includes import, rotation, and tamper-detection capabilities, with 31 automated tests that cover all security invariants.

ASTELIA (PRODUCT LAUNCH)

Astelia is an AI-driven exposure management platform that maps enterprise environments, models attack paths, and prioritizes remediation of exploitable vulnerabilities.

CONFUSABLE-VISION

An offline tool that renders Unicode confusable character pairs across system fonts, measures visual similarity using SSIM, and outputs scored JSON artifacts.

DISCORD CUTS TIES WITH PETER THIEL-BACKED VERIFICATION SOFTWARE AFTER ITS CODE WAS FOUND TIED TO US SURVEILLANCE EFFORTS

Discord terminated its partnership with identity verification vendor Persona after researchers discovered nearly 2,500 accessible files on a FedRAMP government endpoint, revealing the software performs 269 distinct verification checks, including facial recognition against watchlists, politically exposed persons screening, and adverse media categorization across terrorism and espionage categories. Persona's CEO called the exposure publicly accessible front-end code rather than a vulnerability, but the discovery follows a 2025 breach at another Discord verification vendor that exposed government IDs of over 70,000 users. The incident underscores growing supply chain privacy risks in age verification systems, with Persona still serving OpenAI, Lime, and Roblox despite the controversy.

CLAUDE CODE FLAWS ALLOW REMOTE CODE EXECUTION AND API KEY EXFILTRATION

Researchers have uncovered three Claude Code vulnerabilities that enable remote code execution and silent API key exfiltration when developers open malicious repositories, abusing hooks, MCP servers, and environment variables. Exploitation can leak Anthropic API keys, redirect authenticated traffic, and modify cloud data, shifting the threat model from just running untrusted code to merely opening untrusted AI-assisted projects.

WHY ‘CALL THIS NUMBER' TOAD EMAILS BEAT GATEWAYS

Telephone-oriented attack delivery (TOAD) accounted for nearly 28% of all gateway-bypassing email detections across multiple enterprise environments between December 2025 and February 2026. These emails contain only a phone number as the payload, typically impersonating billing notifications from brands like PayPal or DocuSign, making them indistinguishable from legitimate business communications that secure email gateways filter out. The average detected attack combined more than four evasion techniques simultaneously, with over 1,400 unique evasion combinations tracked, representing a 130% increase over the previous study period.

INDIE WEB BROWSER LADYBIRD FLUTTERS TOWARD RUST WITH A LITTLE HELP FROM AI

The Ladybird browser project abandoned Swift adoption and is now using LLM-assisted translation to port its C++ codebase to Rust, converting 25,000 lines of its JavaScript interpreter in two weeks with zero regressions.

CLAUDE COLLABORATION TOOLS LEFT THE DOOR WIDE OPEN TO REMOTE CODE EXECUTION

Researchers have discovered three now-patched vulnerabilities in Claude Code (CVE-2025-59536, CVE-2026-21852) that allowed remote code execution via malicious Hooks and MCP configurations in cloned repositories, plus API key theft through endpoint redirection in project settings files.

DISCORD PUTS GLOBAL AGE VERIFICATION POLICY ON HOLD AFTER BACKLASH

Discord has delayed its global age verification rollout to the second half of 2026 and plans to add credit card verification as an alternative to government IDs or video selfies.