TLDR INFORMATION SECURITY 2026-10-16

Register now

CENTERPOINT ENERGY DATA BREACH IMPACTS 1 MILLION TEXANS

CenterPoint Energy told Texas authorities that a data breach affected 1,062,060 residents. Exposed data includes names, addresses, Social Security numbers, and driver's license numbers. A hacker claimed to have taken nearly 7.5 million records and published a 2.5 GB archive containing about 3 million phone numbers.

HIRUDO ANDROID MALWARE REPLACES BANKING APPS TO EVADE SECURITY CHECKS

Security researchers at ThreatFabric released a report on a malware campaign that targets Android users by impersonating banking apps. The malware is delivered via shopping, adult content, or short-drama apps that appear legitimate but then request additional permissions, such as Accessibility, for an “update.” The malware then launches the legitimate banking app's uninstaller, downloads a patched copy, and abuses its Accessibility permissions to install it.

GARDA SOCIAL MEDIA ACCOUNTS BREACHED BY CRYPTO HACKERS

An Garda Síochána, the Irish police force, confirmed that hackers compromised two of its X accounts. Threat actors removed the branding from @GardaInfo and @GardaTraffic accounts and started publishing posts about cryptocurrency. Users are advised not to interact with these posts while internal investigations take place.

JEV AS A JUDGE: HOW COUNTERFEIT POLICY STEERS JEV

A "counterfeit policy" prepended to untrusted content, supplying Jev's desired answers and redefining every attack category as something harmless, cut the decision model's prompt injection recall from 82.90% to 3.88% across 4,643 benchmark attacks. Datadog researchers then planted the policy in a user-editable profile field. They dropped LangChain tool-risk gating's mean risk score for an unauthorized edit from 0.893 to 0.290, under the 0.5 block threshold. Teams using Jev as a security gate should treat every user-controlled field that reaches the classifier as an attack surface and keep hard authorization checks outside the model.

REDUCING THE NOISE: HOW ATLASSIAN BUILT AN OCSF SECURITY LAKEHOUSE ON DATABRICKS

Atlassian normalized 44 billion daily security events to OCSF by embedding the full schema in Go structs, so every log was validated at compile time, and its agentic mapping workflow could not emit invalid fields. That rigid typing enabled SOC analysts to self-serve log onboarding through a canary-gated pipeline, mapping two-thirds of the data in two months after the first third had taken a year. Standardized entity values like actor.user then enabled the detection team to replace one-to-one alerts with clustered, risk-based signals across 500+ detections.

COPYCATS AT MACHINE SPEED: REPRODUCING FRONTIER WINDOWS KERNEL EXPLOITATION RESEARCH

ITRES Labs researchers fed photos of Juan Sacco's BruCON slides, his since-deleted physmem.exe binary, and older public projects into ChatGPT to rebuild his Native SSDT and Shadow SSDT kernel redirection techniques, reaching SYSTEM on Windows 11 with VBS, HVCI, and kernel shadow stacks enabled. Four months of original research were reproduced in roughly 24 hours of activity, though 39 refusals and broken generated code forced the final Shadow SSDT SYSTEM integration to be finished by hand. Researchers releasing slides or compiled binaries should assume partial disclosures can now be turned into working exploits within days.

no device limits.

HARMONIC SECURITY (PRODUCT LAUNCH)

Harmonic Security secures employee AI use across browser-based AI, desktop tools, and agent workflows. Its models classify tasks, detect risks such as personal-account use and sensitive-data exposure, apply real-time controls, and show which AI use cases create value.

A UNIFIED THREAT HUNTING PROCESS

This repository synthesizes several threat hunting models into a unified process that can be followed by agents or humans.

RAML KQL

Raml KQL is a desktop app for macOS, Linux, and Windows that provides a VS Code-like interface to run KQL queries across many Azure Log Analytics workspaces at once, across many Entra tenants, and many authenticated accounts.

CITIZEN LAB SAYS GOVERNMENTS ARE ABUSING ONLINE ADS TO HACK PEOPLE WITH ‘ZERO-CLICK' SPYWARE

Citizen Lab reports that Israeli firm Discover-Tech's ad platform, Controlium, let spyware vendors Candiru and Bindecy target people through online ads. At least 45 Al Jazeera Windows computers were infected with Candiru spyware in 2024–2025. Exposed source code, login records, and billions of bidding records showed ads reached government, military, and critical-infrastructure devices.

ANTHROPIC 'SNEAKPEEK' FLAW IS A SILENT ZERO-CLICK THREAT

A flaw in Claude Code Desktop's preview pane let malicious HTML in a public repository run automatically when a developer asked Claude to review or edit it. Chained weaknesses bypassed sandbox protections and stole AWS, GitHub, API, SSH, and Claude OAuth credentials. Anthropic patched the issue after Noma found a bypass of the first fix. Developers should update and remove long-lived credentials from workstations.

A UAF TURNED RCE

curl 8.23.0 patched CVE-2026-92392, a HIGH-severity HTTP/2 upload use-after-free that allowed a malicious server to achieve remote code execution when a reset on a paused stream left libcurl holding a dangling pointer to a freed easy handle. During multi-handle cleanup, server data overwrote that freed memory, including a function pointer, while a leaked request exposed local addresses to defeat ASLR. Anthropic's OSS Scanner found the bug, which maintainers rated below CRITICAL because exploitation requires a ~135KB upload and depends on allocation patterns that vary across distros and libc versions.

CISCO MAKE-ME-ROOT EMAIL BUG EXPLOITED AS A 0-DAY BY UNKNOWN CRIMS

Cisco's Secure Email Gateway has an actively exploited zero-day, CVE-2026-76519, rated CVSS 9.8.

DRUPAL PATCHES CRITICAL FIELD UI FLAW WITH UNAUTHENTICATED RCE PATH VIA CONTRIBUTED MODULES

Drupal has fixed CVE-2026-108097, a critical Field UI flaw rated 19/25 that can lead to remote code execution through contributed modules with no authentication.

PASSKEY INDEX 2026

Passkeys now account for 36% of successful sign-ins (up from 26% in 2025), outperform traditional MFA (93% vs 78%), and save users an average of 27 seconds per login.