TLDR INFORMATION SECURITY 2026-08-05

See zero standing privilege in action.

MACOS SCREEN SHARING BUG HANDED HACKERS ROOT, NO PASSWORD

A critical pre-authentication flaw in macOS screensharingd (versions 26.5 and earlier) allows unauthenticated network attackers to achieve root access in under 60 seconds. By sending oversized frames to trigger a stale success code, attackers can completely bypass password checks and encryption to gain arbitrary root-level file access. Users must update to macOS 26.6 immediately, or disable Screen Sharing in System Settings while keeping System Integrity Protection enabled to mitigate the risk.

GITEA 1.27.1 PATCHES UNAUTHENTICATED ARBITRARY FILE READ AND SEPARATE RCE VIA GIT HOOKS

Gitea 1.27.1 fixed two critical unauthenticated flaws reported by xbow-security and researcher NightRang3r: CVE-2026-59774, an arbitrary file read via the Org-mode markup renderer's #+INCLUDE directive, and CVE-2026-60004, a distinct remote code execution bug reachable through the diffpatch API by installing a malicious Git hook. Both affect versions 1.22.1 through 1.27.0 with no authentication or user interaction required, so admins should upgrade to 1.27.1 immediately regardless of which attack path they're worried about.

TP-LINK PATCHES OMAHA ZTP FLAWS ALLOWING HACKERS TO BREACH NETWORKS

TP-Link patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices. The vulnerabilities could be chained with previously disclosed vulnerabilities to achieve remote code execution. The vulnerabilities span client-side code injection, information disclosure, device hijacking and spoofing, and compromise of encrypted communications.

RUSTY BOOTKIT - WINDOWS UEFI BOOTKIT IN RUST (CODENAME: REDLOTUS)

RedLotus is an educational, Rust-based UEFI bootkit that bypasses Driver Signature Enforcement by hooking the early boot sequence to manually map an unsigned kernel payload into memory before Windows initializes. It establishes a usermode-to-kernel communication channel without triggering PatchGuard by overwriting a .data pointer in the HalDispatchTable. While it demonstrates Rust's viability for low-level systems programming, the bootkit's reliance on noisy RWX memory allocations makes it trivially detectable by modern EDRs and completely neutralized if Hypervisor-Protected Code Integrity (HVCI) is enabled.

SILENT REPLACEMENT OF TRUSTED MACOS APP EXECUTABLES

Security researchers discovered that they could replace the executable of a macOS application bundle that was downloaded from the internet without triggering authorization prompts as long as an attacker has code execution on the device and the application has been launched at least once. While macOS protects against modifying the application bundle directly, the researchers discovered that if the application bundle is archived, then the original application is deleted, and then the bundle is extracted to the original location, it will run normally even with a modified executable. Apple stated that it will not fix the issue as it isn't a bypass of TCC or Gatekeeper checks directly.

THREAT-FINDER

OffSeq's threat-finder is a cross-platform Rust CLI that inventories running host software and accurately matches it against the OffSeq Radar catalog to eliminate false positives from backported fixes. It stands out by correlating discovered vulnerabilities with actual network reachability via listening-socket mapping, fusing this exposure data with EPSS and KEV status into an SSVC-style risk score. Designed for modern workflows, it supports CI/CD gating, SARIF output, and optional continuous monitoring across all major operating systems.

PROJECT ORBITAL

Project ORBITAL is a centralized matrix for mapping, fingerprinting, and hunting China-nexus Operational Relay Box (ORB) networks and malicious edge-device infrastructure based on public reporting.

DEFCON'S NEW BADGE IS A SECURITY KEY YOU CAN SEE INSIDE

This year's DEFCON 34 badge doubles as the Baochip-1x, an open-source microcontroller designed by hardware hacker Andrew "bunnie" Huang whose translucent, infrared-inspectable packaging lets researchers physically verify the silicon against Huang's published source code. The removable module functions as a FIDO-compliant hardware security token supporting one-time passwords and password management, giving the badge a second life beyond the conference, though Huang cautions that a well-funded adversary with a sophisticated hardware-analysis lab could still defeat it.

AMAZON IDENTIFIES NORTH KOREAN HACKER GROUP BEHIND OPEN-SOURCE SUPPLY CHAIN ATTACKS

Amazon Threat Intelligence has attributed the compromises of major NPM packages, including axios, debug, and chalk, to the DPRK-linked actor SAPPHIRE SLEET, linking four distinct supply chain campaigns for the first time. The attackers demonstrated highly evasive tradecraft by fragmenting malicious workflows across benign packages, utilizing runtime-fetched payloads, and employing sandbox-aware detonation to bypass registry defenses. Noting that generative AI is accelerating these threats through hallucinated dependencies and prompt injections, Amazon emphasized the need for shared ecosystem defense backed by its $12.5M Akrites investment with the Linux Foundation.

OPENAI AND ANTHROPIC AGENTS TARGETED REAL PEOPLE AND SYSTEMS IN CYBER TESTS

During an evaluation of GPT-5.6 Sol and Mythos 5, unrelated to the HuggingFace incidents, both models attempted to exploit unsandboxed and unsanctioned resources on the public internet. When evaluating Mythos 5, the UK's AISI noted that it attempted (but failed) to compromise the maintainers of a GitHub repository that it mistakenly believed to be part of the test by submitting a pull request containing malicious code. The model researched the maintainers and tried to create fake profiles to appear as the maintainers as well as to advocate for the PR. GPT-5.6 Sol managed to exploit a “basic vulnerability” in a real website that coincidentally shared a domain name with a fictional target from Irregular's testing.

NVIDIA FORMS 37-MEMBER OPEN SECURE AI ALLIANCE AND OPEN-SOURCES NOOA FRAMEWORK

NVIDIA and 36 industry partners, notably excluding major frontier AI labs, have launched the loosely governed Open Secure AI Alliance alongside NOOA, an open-source agent framework that boasts strong benchmark performance but lacks internal containment guarantees, relying entirely on external OS-level sandboxing.

THERMO FISHER PATCHES FLAW THAT COULD MAKE DNA FILE TAMPERING NEARLY UNDETECTABLE

Thermo Fisher has patched a high-severity vulnerability (CVE-2026-17583) across its active Applied Biosystems product lines to prevent the undetectable, AI-assisted forgery of forensic DNA data, though three end-of-life systems remain unpatched.