TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-07-31

5 sections14 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

COSMOSESCAPE: TAKING OVER EVERY DATABASE IN AZURE COSMOS DB

Wiz Research bypassed Cosmos DB's Gremlin sandbox by abusing .NET reflection to achieve arbitrary code execution on the DB Gateway, then extracted a platform-wide "Cosmos Master Key" capable of retrieving any account's primary key and enumerating every database on the service by tenant or subscription ID, including Microsoft's own internal Cosmos DB-backed services like Entra ID, Teams, and Copilot. The flaw affected private and network-isolated accounts as well, since the DB Gateway itself enforced isolation and was the component compromised. Microsoft deployed a hotfix within 48 hours of disclosure, eliminated the master key entirely, and completed a hardened architecture rollout by July. There was no evidence of exploitation beyond Wiz's own testing.

wiz.io6 min read

KINDARAILS2SHELL: CVE-2026-66066, CRITICAL ARBITRARY FILE READ AND POSSIBLE REMOTE CODE EXECUTION IN RUBY ON RAILS

CVE-2026-66066 (CVSSv4 9.5) lets an unauthenticated attacker abuse unfuzzed libvips operations during Active Storage image processing to read files accessible to the Rails process, potentially exposing secrets that enable RCE. Only the default Vips variant processor is affected, not Magick. Fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 alongside libvips 8.13+ and ruby-vips 2.2.1+, with no in-the-wild exploitation reported as of July 30. Rapid7 urges rotating secret_key_base and other exposed credentials, patching outside normal cycles, and applying Vips.block_untrusted(true) as an interim workaround where upgrading isn't immediately possible.

rapid7.com2 min read

ESCAPING THE APPLE SANDBOX BY SPAWNING AN EXECUTABLE

CVE-2026-20628 let a sandboxed macOS process spawn a child with the posix_spawnattr_setmacpolicyinfo_np API specifying a more permissive built-in profile like no-network, which grants home directory access, then chain that into a shell config modification and Terminal launch to fully escape the sandbox. Researcher Noah Gregory reported the bug, which Apple patched in version 26.3 by blanket-denying built-in profile assignment for already-sandboxed processes unless they carry the com.apple.private.security.sandbox-spawnattrs entitlement. Defenders should ensure affected Apple devices are updated to 26.3 or later, as no more granular policy comparison was implemented.

wts.dev2 min read

02STRATEGIES & TACTICS

CONTROL RELIABILITY ENGINEERING (CRE): APPLYING SRE PRINCIPLES TO CYBERSECURITY CONTROLS

Most breaches stem not from novel attacker capability but from security controls that were believed operational yet were actually broken, misconfigured, or never fully implemented, proposing Control Reliability Engineering (CRE) as a direct port of Google's Site Reliability Engineering discipline onto security controls. CRE treats a "Control Incident" (a failed defense, regardless of whether it led to a breach) with the same severity as an actual security incident, applying SLIs/SLOs, error budgets, controls-as-code, continuous control monitoring, and synthetic event injection to catch controls that silently "read zero" while broken. Security teams should build a control ontology/catalog, adopt Control Readiness Reviews before production onboarding, and formalize blameless postmortems for control failures to shift from reactive ticket-based response to engineered, metric-driven control health.

philvenables.com5 min read

THE ONE CHOKEPOINT TO RULE THEM ALL: WHY I DELETED 50 CLICKFIX DETECTION RULES AND REPLACED THEM WITH ONE

ClickFix attacks are a growing class of attacks that trick a user into executing a malicious command by prompting them to fix or otherwise diagnose a bogus issue. At the behavioral level, a ClickFix attack boils down to a browser process losing focus, followed by a native shell gaining focus, followed by a command containing a network call being executed within 60 seconds. The post contains this behavioral detection in several languages and a demonstration of it working against several variants.

ddosier-disects.medium.com11 min read

ZERO RISK ISN'T THE JOB: A CISO'S GUIDE TO AGENTIC AI

This post outlines how Anthropic assesses risk for internal agentic workloads. To understand the risk associated with an agent, Anthropic asks what untrusted content an agent will ingest, what actions the agent can take, what the blast radius is in the case of misalignment, and what observability is available. Anthropic also defines an identity access model spectrum where agents may run as a self-contained, single-purpose, least-privilege identity that does one thing for the business with no human identity on one end and human credential agents where employees use an agent such as a chatbot or Claude Cowork directly on the other end.

claude.com5 min read

03LAUNCHES & TOOLS

CISA-KEV-THREAT-INTEL-ORCHESTRATOR

An n8n workflow that pulls newly weaponized CVEs from the CISA KEV catalog every Monday and uses Google Gemini to auto-generate Sigma detection rules with Sysmon EventIDs and MITRE ATT&CK mappings, logging each CVE to Google Sheets for compliance and emailing analysts a weekly briefing.

github.comGitHub repository

DEDUPINSPECTOR

DedupInspector is a lightweight, portable, offline forensic utility for recovering files from Windows Data Deduplication volumes.

github.comGitHub repository

CODENEEDLE

CodeNeedle is a VS Code extension that silently exposes JavaScript code execution over a local HTTP endpoint. Once loaded into a target's VS Code instance, the extension listens on localhost for incoming JSON-RPC requests, evaluates arbitrary JavaScript code, and returns results to the caller.

github.comGitHub repository

04MISCELLANEOUS

LINUX XMRIG BOTNET ABUSES PAM FOR FILELESS MONERO MINING AND PERSISTENT ACCESS

A V25 (Generation 26) cryptomining campaign gained initial access through a trusted third-party relationship, then weaponized Linux PAM's pam_rootok policy to move password-lessly from root into ordinary user accounts, fragmenting malicious activity across shadowed identities in a "hydra-like" persistence model. The customized XMRig 6.25.0 build self-unlinked its own binary after execution, running fileless from memory while suppressing authentication logs and masquerading its process listings and network traffic. The operation reflects a broader trend in Linux cryptomining tradecraft, where supply chain compromise, identity-layer abuse, and anti-forensic design are converging to outpace file-based and DNS-centric detection models.

gbhackers.com3 min read

SOME THOUGHTS ABOUT ANTHROPIC'S NEW CRYPTANALYSIS RESULTS

Anthropic recently announced that its unreleased Mythos model discovered two novel attacks against the post-quantum cryptography hashing candidate HAWK and a reduced-round AES variant. The HAWK attack was in fact novel, but it only effectively reduced the strength of the cipher by halving the bits, whereas the AES attack was a slight speed-up of a theoretical attack from 2013. The model was able to develop the attacks with a naive prompt, and from that perspective, the results are still meaningful.

blog.cryptographyengineering.com10 min read

CISA SETS A NEW SBOM BASELINE

The CISA has released the 2026 Minimum Elements of a Software Bill of Materials (SBOM) to replace the NTIA's 2021 version. The new version introduces new elements including component hash algorithms, component licenses, the name of the tool that generated the SBOM, and the generation context. CISA highlights cloud software, AI, SBOM validation, and linking an SBOM to security alerts as future areas of development.

helpnetsecurity.com2 min read