TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-10-07

5 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

CITRIX NETSCALER SECURITY SNAFUS GET EVEN WORSE AMID MORE 0-DAY REPORTS

A single crafted request knocks NetScaler ADC and Gateway appliances offline through CVE-2026-88779, a memory overflow zero-day affecting deployments configured as a SAML service provider or identity provider. CISA confirmed active exploitation, and watchTowr told The Register it suspects attackers are crashing appliances deliberately to speed up exploitation of CVE-2026-88771, one of eight NetScaler bugs disclosed September 27. Apply Citrix's fixed build or interim mitigation, starting with Gateway and AAA virtual servers that have SAML enabled, and run Citrix's IOC script while treating a clean result as inconclusive.

theregister.com3 min read

250,000 IMPACTED BY DATA BREACHES AT NEW JERSEY, TEXAS HEALTHCARE FIRMS

Clover Health Investments said attackers used social engineering to compromise three employee accounts, exposing data on 138,677 people. AngMar Management Services found stolen patient data after suspicious activity, affecting 126,196 people. Exposed records included Social Security numbers, diagnoses, medical histories, insurance details, prescriptions, and service dates. The Interlock ransomware group claimed to have stolen 700 gigabytes from AngMar.

links.tldrnewsletter.com2 min read

CVE-2026-19444: HOW COPYING IN KUBECTL BREAKS TRUST

A malicious container can write files anywhere a Windows user's account can reach, including the Startup folder, when that user runs kubectl cp against it (CVE-2026-19444, CVSS 6.5). kubectl cp unpacks the output of whatever tar binary the container ships, and the entry-path check added after three 2019 CVEs never accounted for Windows path separators. Windows clients need kubectl v1.36.5, v1.35.9, or v1.34.12, since the flaw is in client-side extraction and the cluster version does not matter.

edera.dev5 min read

02STRATEGIES & TACTICS

WORDPRESS LIBHEIF RCE: EXPLOIT CHAIN

Fortbridge has published the first public exploit chain for a libheif heap overflow (GHSA-x8r2-mggj-j6wr) originally discovered by Alex Thomas and Wordfence. By uploading crafted HEIC images via the WordPress Media Library, an authenticated attacker can defeat ASLR using pixel values in generated JPEGs and hijack a C++ virtual table pointer to achieve remote code execution. Administrators should update libheif to 1.23.3, disable unused HEIC/AVIF uploads, and treat repeated PHP-FPM 503 errors on image uploads as security events.

fortbridge.co.uk11 min read

MALFEX NPM MALWARE CAMPAIGN: THREE PAYLOADS AND AN ADVERSARY THAT SIGNS THEIR WORK

MALFEX, an npm campaign run by a single operator, published eight malicious packages that targeted Windows systems. Its payloads included Overlord RAT and movinlike, a stealer that took Discord tokens, browser credentials, Telegram sessions, and cryptocurrency wallets. Three packages remain installable (function-flag, function-color, and cdn-img-fetch), and the first two have no advisory.

checkmarx.com12 min read

A VAULT WITH A HEAP-VIEW: THE UNCOMFORTABLE SPACE BETWEEN AGENTCORE HARNESS AND IDENTITY

AWS AgentCore Harness is an agentic service and AgentCore Identity is a service that provides agents with identities. Unit 42 discovered that the bash tool that is enabled by default on AgentCore agents runs arbitrary bash commands and code as root. Using this primitive, the researchers demonstrated that they could exfiltrate the AgentCore Identity JWT by scanning the heap for it and then exfiltrating it.

unit42.paloaltonetworks.com16 min read

03LAUNCHES & TOOLS

GDP-TS

gdp-ts is a TypeScript library, linter, and agent skill that turns skipped or mismatched authorization checks into compile errors. Sensitive functions demand a type-level proof, minted only by a trusted check module, that this exact user was authorized for this exact resource, with near-zero runtime cost. A lint preset blocks forged proofs via as casts, and the bundled skill steers coding agents toward the pattern.

github.comGitHub repository

MCPWARD

mcpward pins an MCP server's tool contract to a committed lockfile and fails CI when it drifts, catching silently rewritten descriptions (rug-pulls), readOnlyHint flips, and breaking schema changes. It works black-box against any stdio or HTTP server and runs fully offline with no account or telemetry, unlike Snyk Agent Scan. It also flags tool-poisoning patterns such as injection phrasing and hidden Unicode, with output to SARIF, JUnit, or a PR comment.

github.comGitHub repository

POC INDEX

Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit, and Vulhub.

github.comGitHub repository

04MISCELLANEOUS

MCP FOR AGENT-TO-AGENT COMMS MAY BE THE RISKIEST PROTOCOL YOU'VE NEVER HEARD OF

Google and four other organizations acknowledged flaws over the past five months where a prompt injection landing on one AI agent over MCP was forwarded to other internal agents, which executed it on trust. Researcher Syed Anas Mohiuddin named the technique "protocol pivoting," though X41 D-Sec's Markus Vervier told Ars Technica it is plain indirect prompt injection. The bugs typically ended in SSRF, ranging from severity 2.7 at Rapid7 (CVE-2026-97228) to 8 in Google's mcp-toolbox, which followed redirects without validating target IPs.

arstechnica.com5 min read

IS SANDBOXING SUFFICIENT TO CONTAIN ROGUE AGENTS?

When discussing the OpenAI and other agent escapes, the conversation inevitably turns to discussing sandboxes. OpenAI has not demonstrated to this point a serious containment strategy, so this discussion may hold weight. However, sandboxes are not sufficient as useful agents need Internet access as well as the fact that agents are potentially overeager.

blog.cryptographyengineering.com10 min read

NTS: AUTHENTICATED TIME AT META

Meta added Network Time Security (RFC 8915) to its public time service at nts.meta.com, so on-path attackers can no longer forge the clock that certificate, token, and replay-window checks rely on. Its servers hold no per-client state because each one derives the cookie-sealing key from a shared master secret and the Unix epoch day using HKDF-SHA256. NTS does not stop delay attacks or prevent an authenticated server from being simply wrong, and the stock Android and iOS time clients still sync over unauthenticated packets.

engineering.fb.com12 min read