TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-09-17

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

HUMAN ATTACKER HITS MACHINE-SPEED EXPLOITATION OF MARIMO RCE

A human attacker exploited CVE-2026-39987 to achieve pre-authentication remote code execution and harvest cloud credentials from Marimo notebooks. The Sysdig Threat Research Team observed the operator pivot from the vulnerable terminal WebSocket endpoint to an SSH bastion host in eight seconds to access an AWS Secrets Manager SSH key without using large language models. Defenders must focus detection efforts on the shape of the attack chain rather than specific operator fingerprints, because prompt injection traps designed for AI agents failed to identify the human actor.

infosecurity-magazine.com2 min read

CHINESE HACKERS EXPLOIT CRITICAL TENCENT SOFTWARE FLAW FOR ONE-CLICK CODE EXECUTION

China-linked UNC3569 used a single crafted link to gain system-level code execution through Sogou Input Method, Tencent's Chinese-language keyboard app used by hundreds of millions of Windows users, and deployed its GrayRabbit backdoor. Gen Threat Labs found that CVE-2026-51990 chained argument injection in the sgbiz protocol handler with a bundled Chromium 80 browser that was six years out of date, ran without a sandbox, and dropped same-origin protections. Tencent patched the injection bug in version 16.3.0.3498, but the outdated Chromium engine behind the chain remained unchanged as of September 10.

links.tldrnewsletter.com3 min read

TEXAS UTILITY CENTERPOINT ENERGY CONFIRMS DATA BREACH AFTER HACKER CLAIMS 7.49M RECORDS STOLEN

CenterPoint Energy confirmed an attacker pulled customer data through an external-facing API on September 12. A hacker using the alias "4d722e4d656f77" claims 7.49 million records, including names, phone numbers, billing addresses, account numbers, payment status, and partial Social Security numbers. The attacker says the API lacked WAF protection, rate limiting, and JWT/auth tokens, and stopped only after a CAPTCHA was added.

securityaffairs.com3 min read

02STRATEGIES & TACTICS

THREAT HUNTING WITH JA4/JA4S (+ PRACTICAL KQL QUERIES)

JA4 is a TLS fingerprint that shows how a client connects, not just where it connects to. Unlike JA3, part of it is readable, so hunters can see the TLS version, SNI, cipher count, and ALPN at a glance. The post includes KQL queries to pull these values from Entra ID sign-ins and Defender network logs, so teams can learn what normal looks like and spot clients that don't match.

detect.fyi5 min read

THE £3 WIFI EXTENDER WITH A BACKDOOR IN EVERY UNIT

A £3 Z05L WiFi extender uses an MT7620 chip and a four-megabyte Winbond flash. Its firmware starts Telnet on every boot with root password 198277tt@, and the web API accepts requests without session checks, so a mac parameter can reach system() without validation, allowing root command injection. Firmware updates verify CRC32 values only, allowing forged images, and the firewall leaves inbound services exposed on bridged networks as the config partition stores WiFi credentials in plaintext.

affixsec.substack.com13 min read

PARASHELLS: PARALLELS DESKTOP TURNS APPLIANCE INSTALL INTO A ROOT SHELL

CVE-2026-90894 lets a non-admin macOS user gain root through Parallels Desktop's appliance installer. JFrog tested Desktop 26.4.0 build 57513 on Apple Silicon. The root daemon exposes a world-writable Unix socket where an unsigned local process can authenticate through PrlSrv_LoginLocal. A quote in sVmParentPath injects tar's --use-compress-program option, and tar then launches an attacker script as root. Parallels released version 27.0.0 on September 1 to fix this issue.

jfrog.com9 min read

03LAUNCHES & TOOLS

Sponsored

REACH SECURITY PROFESSIONALS READING TLDR

If you're reading this ad, you know they work. TLDR subscribers make a deliberate choice to open their inbox every weekday. You reach security engineers, CISOs, and infosec leaders at the precise moment they're most receptive to new information shaping their work. Become a TLDR sponsor. [10]

advertise.tldr.techSponsor

ENTRUST TURNS CRYPTOGRAPHIC INVENTORY DATA INTO SECURITY ACTION

Entrust added Cryptographic Bill of Materials (CBOM) import and export to its Cryptographic Security Platform, so teams can map which systems depend on weak or noncompliant keys and certificates and fix the riskiest first. The update also brings Ansible-based certificate automation, composite algorithms for phased post-quantum migration, and SPIRE support for AI agent and workload identities. The platform now runs as a service or on-premises, which matters as DORA, NIS2, and the recent US Executive Order push for CBOM-based inventories.

helpnetsecurity.com3 min read

HACKUITY (PRODUCT LAUNCH)

Hackuity consolidates vulnerability and asset data from 130+ security products and ranks flaws by severity, exploitability, asset criticality, threat activity, and business impact. Teams can assign and coordinate remediation across security, IT, cloud, and engineering.

hackuity.ai

VOL-RS

vol-rs is a port of the Volatility 3 memory forensics framework from Python to Rust.

github.comGitHub repository

04MISCELLANEOUS

ACTIVE EXPLOITATION ATTEMPTS TARGET WSO2 API MANAGER JWT BYPASS WITH FORGED ADMIN TOKENS

WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.

thehackernews.com2 min read

REVERSE-ENGINEERING FIND MY PEOPLE TO STALK MY EX A FRIEND, CAUSE I CAN

An in-depth guide to how the author decided to reverse-engineer Apple's Find My system to register a Linux device and (consensually) track a friend. The author first started by attempting to use the iCloud web API but quickly discovered that it didn't support Find My. After reversing and fuzzing the flow, the author was able to reproduce the process by: authenticating to Apple's private service, registering the Linux machine as an IDS client, receiving the existing Find My share key, and using it to fetch and decrypt the friend's latest location.

zerotistic.blog21 min read

GOTTHEIMER PUSHES BACK ON THIRD-PARTY AUDITS OF ADVANCED AI

A new AI regulatory framework, the FRONTIER Act, includes a provision that would require third parties to audit the safety of new frontier models. Rep. Josh Gottheimer pushed back and stated that frontier models should instead need to be submitted to the federal government for a short-clocked review cycle before release.

politico.com1 min read