TLDR INFORMATION SECURITY 2026-09-23

ACCESS THE FULL REPORT

TANSTACK NPM SUPPLY CHAIN ATTACK EXPOSES 170 PRIVATE CROWDSEC GITHUB REPOSITORIES

Attackers used a former CrowdSec employee's GitHub OAuth token following the May TanStack compromise. On May 22, they cloned about 170 private repositories within nine minutes. The leaked archive contained private code and contact data for 83 users. Investigators found no code changes, CI/CD access, or AWS access. The attackers tested one scoped SNS credential, but IAM permissions blocked it.

MUSE, META'S EXTRAORDINARILY PRIVILEGED AI ASSISTANT, HAS A SERIOUS 0-DAY

A zero-day allows any local macOS app or terminal command to redirect Muse transcription to an attacker-controlled server. The server receives the account token, enabling control over Muse and its connected email, WhatsApp, calendar, social accounts, microphone, camera, and files. Researcher Patrick Wardle demonstrated prompts that write files or take photos. Amazon also blocked Muse shopping requests as unauthorized.

SHINYHUNTERS HACKS CLOP LEAK SITE, THREATENS TO EXTORT RANSOMWARE GANG

The ShinyHunters ransomware gang hacked the Clop ransomware gang's data leak site on Tor, defaced it, and claimed to have stolen server data and private keys for its onion service. The ShinyHunters claim to have exploited an unauthenticated file upload vulnerability in Grav CMS to breach the site. This appears to be the latest escalation in an ongoing feud between the two ransomware gangs.

A SCENARIO TO EVALUATE YOUR AGENTIC SOC

A SOC investigation loop requires assembling a full attack chain from various different signals that may look benign or unrelated, which traditional, deterministic playbooks may miss. The authors built a set of scenarios to evaluate agentic SOC's investigative ability and built their own harness (called Tengu). Their scenario involves a GitHub workflow vulnerability that leads to full Kubernetes cluster compromise, which then is escalated to full AWS account compromise. Of the models tested on a naive prompt, only Opus 5 managed to identify the alert as a true positive without the Tengu harness

INFOSTEALERS HAVE FOUND A NEW TARGET: YOUR AI AGENT

Researchers from Gen have observed multiple new infostealers that harvest credentials, context, and local data from AI agents. Users and security teams should inventory what gets cached locally, keep secrets out of prompts and history, limit what connectors can do, and continue securing endpoints. Agent providers should also share the burden by providing more secure default behaviors.

THE CLOSED QUORUM: INSIDE THE FIRST REPORTED AUTONOMOUS AI C2 IMPLANT

CLOSEDQUORUM, a Go-based Windows implant, uses DeepSeek, Qwen, Mistral, and Gemini as its C2. Every 5 to 15 minutes, the models vote through a constrained JSON schema on whether to steal LSASS, browser, and crypto wallet credentials, inject shellcode, or persist via Run keys, scheduled tasks, and WMI. Talos hasn't seen it in the wild, and the public build is an inert template, but it points to a credentials-as-a-service model where each operator gets a custom build and never needs to be online. Its dependence on commercial APIs brings refusals, rate limits, and a deterministic DeepSeek tiebreak, so defenders should correlate multi-provider LLM traffic from unexpected executables with LSASS access, suspended-process injection, WMI persistence, and Discord webhook exfil instead of blocking domains.

packages.

HELMGUARD (PRODUCT LAUNCH)

HelmGuard provides governance, risk, compliance, and security software. It gathers evidence from source systems, documents, and unstructured data, then automates risk assessments, assurance tasks, and control-gap reviews.

ASKWAM

askWAM is a tool to request Microsoft Entra access tokens silently through Windows Web Account Manager (WAM).

DARKCLOAK

DARKCLOAK chains the manipulation of all userspace-visible identity sources into an 11-phase sequential pipeline that progressively transforms a process until it becomes indistinguishable from the impersonated one to userspace monitoring tools.

ANTHROPIC-LINKED CVES PILE UP, ATTACKERS MOSTLY SHRUG

VulnCheck's Patrick Garrity tracked 225 CVEs tied to Anthropic's Project Glasswing, which gives partners access to the Claude Mythos Preview model for bug-hunting. Only one, a critical SQL injection in Ghost (CVE-2026-26980), has been exploited in the wild. Garrity says that historically 1-2% of vulnerabilities are weaponized, so this rate isn't unusual. AI models are uncovering more bugs, driving recent record patch counts from Microsoft, Apple, and Palo Alto Networks, but fixing bugs remains weak: 1Password found that Opus 4.8 and ChatGPT-5.5 fully resolved vulnerabilities in only 26% of 6,080 patches tested, and Veracode measured a 56% average security pass rate across 100+ models.

GOOGLE HIT WITH $463 MILLION FINE FOR EU LOCATION DATA RULE BREACH

Ireland's Data Protection Commission fined Google 403 million euros for GDPR breaches involving location data. The probe covered Web & App Activity, Location History, and Android's Location Accuracy feature from 2018 through February 2020. Regulators found the processing unlawful, unfair, or opaque, even though Google said it changed its policies and released new location-management tools in 2019.

SHINYHUNTERS CLAIMS FBI HACK, DATA THEFT IN PEOPLESOFT ZERO-DAY BREACH

The ShinyHunters claim to have breached the FBI's job site and networks using a zero-day in Oracle PeopleSoft. The ransomware gang claims to have stolen 2-3TB of data, including PII and PHI of current and former FBI employees and job seekers, as well as other internal records. The hackers said they carried out the attack in retaliation for an FBI FLASH report on ShinyHunters.

BREVO SUPPLY CHAIN ATTACK INJECTS MALWARE INTO 100,000 WEBSITES

Attackers exploited Brevo SAML SSO handling, accessed 138 accounts, and later used a stolen Cloudflare API key.

CRITICAL CHECK POINT MANAGEMENT FLAW LETS UNAUTHENTICATED ATTACKERS RUN CODE AS ROOT

Check Point patched CVE-2026-91843, a CVSS 9.8 login stack overflow.

GLIBC LD.SO TOCTOU LETS LOCAL USERS HIJACK $ORIGIN ON SETUID BINARIES

A race in glibc's ld.so (CVE-2026-86805, versions 2.14 through 2.44) lets local users hardlink a setuid binary whose $ORIGIN RPATH uses ".." traversal and swap in a symlink to load attacker code with elevated privileges.