CyberTLDR

IT Updates
Threats
Hacks
Security Tips
Cybersecurity, Information Security TLDRs

[CyberTLDR @CyberTLDR]

Apple patched CVE-2026-28950, a flaw where iOS Notification Services unexpectedly retained deleted notifications. The bug allowed the FBI to recover Signal messages from a push notification database even after the app was uninstalled
#FBI #Signal #iOS #Apple #cybersecurity

[CyberTLDR @CyberTLDR]

3/3 Be cautious giving AI browser extensions agentic access to sites you are logged into. Limit permissions. Developers should enforce strict separation between user instructions and web page content in any agent that can read and act on live pages. #AISecurity #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 BioShocking tricks AI browsers into leaking login credentials. Tested against ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude extension. A malicious page disguises an attack as game rules and the agent hands over passwords. #AISecurity #cybersecurity #PromptInjection

[CyberTLDR @CyberTLDR]

2/3 AI browsers receive page content and user instructions as one text stream. Malicious pages embed attacker commands as game rules. The agent cannot distinguish them and follows the injected instruction, silently leaking credentials. #BioShocking #PromptInjection #infosec

[CyberTLDR @CyberTLDR]

3/3 Verify your AI coding agent defends against shell metacharacter injection before using it on untrusted code. Run agents in sandboxed environments with limited access. Never let coding agents touch secrets not scoped to the current task. #AISecurity #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 GuardFall: 10 of 11 open-source AI coding agents can be bypassed to run dangerous shell commands. A malicious repo silently steals SSH keys and cloud credentials with your full account access. #AISecurity #cybersecurity #infosec

[CyberTLDR @CyberTLDR]

2/3 Agents check commands against a text blocklist. GuardFall uses shell tricks that bash rewrites at runtime. The agent approves safe-looking text; the shell runs the dangerous command. Only 1 of 11 agents tested was defended. #GuardFall #ShellInjection #AISecurity

[CyberTLDR @CyberTLDR]

3/3 Patch LoadMaster now. A full exploit walkthrough is public, making weaponization imminent. If patching is delayed, disable external API access and audit API logs for crafted or unexpected requests hitting your load balancer. #PatchNow #NetworkSecurity #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 Progress Kemp LoadMaster has a pre-auth RCE flaw (CVE-2026-8037, CVSS 9.8). No auth needed to run root commands via a crafted API request. A full exploit chain dropped June 29. This sits at your network edge. Patch now. #CVE #cybersecurity #vulnerability

[CyberTLDR @CyberTLDR]

2/3 The bug is in escape_quotes(), which sanitizes user input before passing it to a shell command but fails. Attackers send a crafted API request, input hits the shell unsanitized, and they get root execution with no credentials required. #CVE2026_8037 #infosec

[CyberTLDR @CyberTLDR]

3/3 Patch Langflow immediately. Never expose AI dev tools directly to the internet. Require auth on all API endpoints, use network segmentation, and watch for unexpected outbound connections or CPU spikes on your AI app servers. #PatchNow #AISecurity #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 Langflow CVE-2026-33017 (CVSS 9.3) is actively exploited to drop Monero miners on AI endpoints. No auth required. Attackers eval Python in an unauthenticated API to fetch and run a miner binary. Exposed AI dev infra is a live attack surface. #CVE #Langflow #cybersecurity

[CyberTLDR @CyberTLDR]

2/3 One line of Python evaluated in Langflow's unauthenticated API pulls a shell script, fetches a miner binary, and launches it detached. The campaign also kills competing miners from Kinsing, WatchDog, Rocke, and Outlaw groups. #CVE2026_33017 #malware #infosec

[CyberTLDR @CyberTLDR]

3/3 Patch SimpleHelp now. CVE-2026-48558 is CVSS 10.0 and actively exploited. Audit Technician sessions for forged tokens. Monitor for node.exe running scripts named jquery.js in unexpected locations on your systems. #PatchNow #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 SimpleHelp CVE-2026-48558 (CVSS 10.0) is actively exploited. Attackers forge OIDC tokens to gain Technician sessions, then deploy TaskWeaver and Djinn Stealer. Djinn harvests cloud credentials on Windows, macOS, and Linux. #CVE #cybersecurity #malware

[CyberTLDR @CyberTLDR]

2/3 After the OIDC auth bypass, attackers drop TaskWeaver, an obfuscated Node.js loader disguised as jquery.js. It delivers Djinn Stealer as a second stage to steal cloud credentials across all three major operating systems. #CVE2026_48558 #infosec

[CyberTLDR @CyberTLDR]

3/3 Apply Oracle's Critical Patch Update to E-Business Suite 12.2.3-12.2.15 now. Block external HTTP access to Oracle Payments at the perimeter. Monitor for anomalous Oracle API traffic in your environment. #PatchNow #Oracle #cybersecurity

[CyberTLDR @CyberTLDR]

1/3 Oracle E-Business Suite CVE-2026-46817 (CVSS 9.8) is under active attack. Unauthenticated attackers can take over Oracle Payments via HTTP. Versions 12.2.3-12.2.15 affected. Oracle patched this last month. Patch now. #CVE #Oracle #cybersecurity #vulnerability

[CyberTLDR @CyberTLDR]

2/3 The flaw is an auth bypass in Oracle Payments. No credentials needed. A network attacker sends a crafted HTTP request and achieves full system takeover. Defused Cyber observed active exploitation over the weekend. #CVE2026_46817 #Oracle #infosec

[CyberTLDR @CyberTLDR]

3/3 Audit your Chrome extensions now. Remove anything you do not recognize. Only install from trusted developers with verifiable identities. Treat browser extensions like software installs: they have full access to everything you type. #infosec #chrome #devsecops #appsec

[CyberTLDR @CyberTLDR]

1/3 A fake Perplexity AI Chrome extension was caught intercepting every search query and address bar keystroke. Extension ID flkebkiofojicogddingbdmcmkpbplcd, hosted at perplexity-ai[.]online. Up to millions potentially exposed. #infosec #chrome #cybersecurity #threatintel

[CyberTLDR @CyberTLDR]

2/3 The extension registered as a default search handler and used onBeforeRequest listeners to exfiltrate queries before they left the browser. No user interaction needed after install. The lookalike domain made it hard to spot. #browserextension #malware #infosec #phishing