TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-08-06

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

READ THIS BEFORE YOU INVEST IN AI TOOLS

AI is everywhere right now. But for many teams, the reality hasn't matched the promise. So what's _actually_ working? Tines recently released a guide [5] that takes a more practical look at AI adoption for security and IT teams. Inside, you'll find: * A framework for EVALUATING TOOLS BEYOND THE DEMO * A step-by-step approach to selecting tools that HOLD UP IN PRODUCTION * QUESTIONS TO ASK before committing to a vendor * Best practices for KEEPING HUMANS IN THE LOOP If you're thinking about AI beyond experimentation, this is a useful place to start.

tines.comSponsor

02ATTACKS & VULNERABILITIES

SHAI-HULUD NPM WORM RETURNS, POISONING OVER 1,280 NPM PACKAGES

A new Shai-Hulud worm variant has compromised over 1,280 npm packages, including the well-known Keyv library, by injecting malicious commits via hijacked GitHub Actions pipelines. The worm employs a preinstall hook to download Bun and run an obfuscated payload that aggressively extracts developer and cloud credentials such as AWS, Kubernetes, and Vault, which it then uses to spread further. Organizations that have installed affected versions should assume an immediate breach, requiring them to rotate all secrets immediately and perform manual log reviews, rather than waiting for scheduled vulnerability scans.

hackread.com3 min read

77 OPEN VSX EXTENSIONS FOUND HARVESTING DEVELOPER INFO

Manifold Security uncovered an "evil twin" campaign on the Open VSX registry involving 77 malicious extensions that impersonated legitimate packages to harvest developer environment data. While claiming to only collect anonymous metrics, the most aggressive variants actively exfiltrated OS usernames, workspace paths, Git commit hashes, and CI/CD infrastructure details to mangorbit[.]com, utilizing DNS TXT lookups for C2 resilience. Although Open VSX removed the packages on August 3, security teams should block the C2 domain and manually audit developer environments for the malicious extension IDs.

links.tldrnewsletter.com3 min read

ENGLISH NATIONAL BALLET SUFFERS SUPPLY CHAIN ATTACK

English National Ballet (ENB) disclosed that customer information was stolen via a breach of its customer relationship management (CRM) system. ENB stated that no password or financial information was stolen and advised customers to be vigilant of phishing emails.

bbc.com2 min read

03STRATEGIES & TACTICS

HARDWARE HACKING: FROM ZERO TO A PRE-AUTH STACK BUFFER OVERFLOW ON AMAZON'S BEST-SELLING ROUTER

Researcher Rotce rooted the Mercusys MB115-4G, Amazon Spain's best-selling router, via UART and traced a pre-auth path in /usr/bin/httpd where http_gdpr_decrypt copied up to 2048 bytes of AES-decrypted, attacker-controlled data into a 512-byte caller buffer with no bounds check, tracked as CVE-2026-12495. The bug was surfaced through disciplined static analysis rather than a working exploit, following the routing table into the login handler in Ghidra and confirming with Ghidriff that the flaw persisted unpatched from v1.7.0 through v1.9.0. Mercusys' own validation reproduced the crash and shipped a fix in v1.11.0 that added the missing bounds check, moved the login decrypt path from RSA to ECC, and introduced HMAC verification.

rotcee.github.io16 min read

PHISHING SERVICE SPOOFS RINGCENTRAL TO STEAL MICROSOFT 365 ACCOUNTS

The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.

links.tldrnewsletter.com3 min read

AGENTIC INCIDENT RESPONSE NOTEBOOKS

The DNB Cyber Defense Center's incident response team used marimo to build out incident response workflows as modular notebooks. The team developed a custom SDK for cross-platform query translation across Splunk, Defender, and SQL interfaces while utilizing marimo's native cell dependencies and caching capabilities. The marimo-pair agentic interface also allows agents to create and execute the same notebooks as human responders.

blog.cauchy.org6 min read

04LAUNCHES & TOOLS

AGENTHOUND

AgentHound is an open-source offensive security framework for AI agent infrastructure that can perform recon, fingerprinting, credential looting, system prompt inventorying, model inversion, tool and instruction poisoning, and config-implant persistence and exports results to a Neo4j graph.

github.comGitHub repository

BEIGNET

Beignet is a tool to convert .dylib files into macOS PIC shellcode.

github.comGitHub repository

05MISCELLANEOUS

HEVD: FROM STACK OVERFLOWS TO MODERN POOL GROOMING

This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.

sibouzitoun.tech1 min read

NEW PASS-TA-KEY ATTACKS LET MALWARE HIJACK GOOGLE-SYNCED PASSKEYS

Palo Alto Networks' Unit 42 has released details of three new attack techniques, which it calls Pass-ta-key, that an attacker with access to a TPM-equipped Windows device can use to abuse Google Password Manager's synced passkeys to steal passkeys. The first technique allows the attacker to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. If a site checks the User Verified flag of the response, the authentication can fail. The other two attack techniques go further by allowing the attacker to register their own user-verification key or even obtain the master key, which is used to encrypt all passkeys synced through the victim's Google Password Manager.

links.tldrnewsletter.com2 min read

CANADIAN MAN PLEADS GUILTY TO HACKING US CLOUD STORAGE PROVIDER AND EXTORTING ITS CUSTOMERS FOR MILLIONS

Connor Riley Moucka pleaded guilty to multiple federal charges after using stolen credentials to breach over 165 SaaS customers between February and October 2024. The campaign compromised billions of records across more than 100 million individuals and caused roughly $9.5 million in corporate damages. Moucka successfully extorted over $2.5 million from his victims and now faces up to 30 years in federal prison at his upcoming October sentencing.

databreaches.net2 min read