TLDR INFORMATION SECURITY 2026-03-02

Save your Seat

CANADIAN TIRE 2025 DATA BREACH IMPACTS 38 MILLION USERS

A 2025 e‑commerce breach at Canadian Tire exposed data from over 38 million accounts, including names, contact details, hashed passwords, and partial card numbers, with under 150,000 records containing full dates of birth. Financial systems and in‑store transactions were reportedly unaffected, but 42 million records were added to Have I Been Pwned.

MANOMANO DATA BREACH AFFECTS 38 MILLION CUSTOMERS VIA THIRD-PARTY PROVIDER

DIY marketplace ManoMano is notifying about 38 million affected customers after unauthorized access at a subcontracted customer service provider handling Zendesk-based interactions. Threat actor “Indra” claims to have compromised data for 37.8 million accounts, including names, emails, phone numbers, and support communications.

COPS BACK DUTCH TELCO ODIDO AFTER SECOND WAVE OF SHINYHUNTERS LEAKS

ShinyHunters is dumping Odido customer records in daily batches, exposing sensitive identifiers, bank details, and support notes, and threatening to escalate the leaks after already impacting more than a million accounts. Dutch police publicly support Odido's stance of refusing ransom payments and emphasize the need for rapid law enforcement engagement and anti‑phishing vigilance.

DELINEA PROTOCOL HANDLER - RETURN OF THE MSI: RCE VIA CUSTOM LAUNCHER

AmberWolf disclosed an RCE vulnerability in Delinea's Secret Server Protocol Handler (≤6.0.3.39) and Connection Manager (≤2.7.1) where improper sanitisation of the sslauncher:// URL handler's generic process launcher allowed a malicious server to supply attacker-controlled process names and arguments via encrypted launcher data, achieving arbitrary code execution on both Windows and macOS when a victim visits a crafted webpage and accepts a security prompt. The exploit, implementable as a NachoVPN plugin, abuses the legitimate key exchange flow to inject serialized launcher configurations that RDPWin.exe blindly executes via Process.Start(). Delinea patched the protocol handler as of January 17. Organizations should upgrade immediately and monitor for anomalous child processes spawned by RDPWin.exe.

TWITCH SHIPS SERVER-SIDE EPPO KEYS IN ITS IOS APP, EXPOSING ITS ENTIRE PRODUCT ROADMAP

Twitch's iOS app uses server-side Eppo SDK keys instead of client tokens, exposing over 260 unobfuscated production feature flags via a CDN endpoint that can be freely polled once a key is observed in traffic. The flags reveal Twitch's near-term roadmap. Hardcoded IDs, internal codenames, and future launches like “Elevate Prime 2026” are visible, turning feature flags into a live intelligence feed on product, security posture, and internal economics.

PROCESS PRELUDING: CHILD PROCESS INJECTION BEFORE THE STORY BEGINS

Many security products in Windows 10 and 11 use kernel Event Tracing for Windows (ETW) hooks to monitor process creation and be notified of potentially malicious activity. An attacker can bypass these checks by exploiting a race condition between the kernel's completion of the executive process object setup and the invocation of process-creation callbacks. Attackers can also use legacy APIs for process creation, which do not trigger process-creation callbacks.

MACNOISE

MacNoise is a modular macOS telemetry-generation framework designed to help security teams validate EDR, SIEM, and firewall detection coverage by producing real system events across the network, process, file, TCC, and persistence categories. The tool includes MITRE ATT&CK-mapped modules, pre-built APT emulation scenarios, and OCSF 1.7.0-compliant audit logging for structured correlation. Scenarios can be dry-run previewed, chained via YAML, and output as JSONL for automated detection gap analysis.

RUSTDESK

Rustdesk is an open-source remote desktop application designed for self-hosting. An alternative to TeamViewer, it works out of the box with no configuration required. You have full control over your data, with no security concerns.

KSENTINEL

ksentinel is a Linux kernel module that monitors syscall table integrity, function prologues, and LSTAR MSR values using FNV-1a hashing to detect unauthorized modifications from rootkits such as PUMAKIT, Diamorphine, and KoviD. It covers 500+ syscall wrappers, plus critical VFS, networking, credential, and tracing functions, with anti-unload protection via a compile-time-generated unlock key. The module supports Linux versions 5.4 to 6.12+ on x86_64 and ARM64. It features configurable check intervals and a management script for live monitoring and violation alerts.

CRITICAL FLAWS EXPOSED GARDYN SMART GARDENS TO REMOTE HACKING

Researchers reported flaws in Gardyn Home and Studio, which exposed roughly 138,000 indoor smart gardens to unauthenticated, internet‑reachable remote compromise, including OS command execution via command injection and hardcoded admin credentials in the Gardyn IoT Hub and Azure IoT infrastructure. Thankfully, patches are out and auto‑delivered.

WHAT IS EC2 INSTANCE ATTESTATION

Nitro enclaves were introduced in 2020 to provide a trusted execution environment for security-sensitive applications. However, application development was more complex due to the execution environment's limitations. Last year, AWS launched EC2 instance attestation, which extends the security enclave to the full instance, enabling more use cases and improving usability at the cost of greater effort to secure the instance and increased deployment complexity. This post walks through the process of creating an application running on an EC2 instance with attestation, including a GitHub Actions workflow to build a hardened, attestable AMI.

DEMYSTIFYING ZERO TRUST

This part of the UK's NCSC multi-part guide on implementing zero trust in an enterprise focuses on defining zero trust beyond the buzzword or a specific product. Zero trust defines a strategic shift where users are continually authenticated as opposed to a point-in-time authentication at the beginning of a session. It implies a defense in depth approach where controls are layered in a system and may work in conjunction with existing systems or replace them.

Free Endpoints

SPAIN ARRESTS SUSPECTED HACKTIVISTS FOR DDOSING GOVT SITES

Spanish Civil Guard arrested four alleged members of "Anonymous Fénix" for conducting DDoS attacks against government ministries and public institutions.

MULTIPLE ZERO-DAY FLAWS IN PDF PLATFORMS ENABLE XSS AND ONE-CLICK ATTACKS

Novee Security disclosed 16 zero-day vulnerabilities across Foxit and Apryse PDF platforms.

MALICIOUS STRIPEAPI NUGET PACKAGE MIMICKED OFFICIAL LIBRARY AND STOLE API TOKENS

A typosquatted NuGet package named "StripeApi.Net" impersonated the legitimate Stripe.net library with artificially inflated download counts (~180K across 506 versions) and silently exfiltrated Stripe API tokens while maintaining full payment processing functionality to avoid detection.