Email: Adobe Commerce attack 🛒, SAP OVERPASS max flaw 💥, ClearFake WebDAV chain 🔗

Subject:
Adobe Commerce attack 🛒, SAP OVERPASS max flaw 💥, ClearFake WebDAV chain 🔗
Received:
9/10/2026, 1:22:26 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;
		&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;
		&lt;meta charset="UTF-8"&gt;
		&lt;meta name="viewport" content="width=device-width"&gt;
		&lt;meta name="x-apple-disable-message-reformatting"&gt;
		&lt;title&gt;TLDR InfoSec&lt;/title&gt;
		&lt;meta name="color-scheme" content="light dark"&gt;
		&lt;meta name="supported-color-schemes" content="light dark"&gt;
		&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;
		&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;
	&lt;/head&gt;
	&lt;body class=""&gt;





		&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;Threat actors are actively exploiting CVE-2026-75650, a max-severity unauthenticated code execution vulnerability dubbed StyleSmuggler&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
		&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
			&lt;br&gt;
		&lt;/div&gt;

		&lt;table align="center" class="document"&gt;
			&lt;tbody&gt;
				&lt;tr&gt;
					&lt;td valign="top"&gt;

						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;
							&lt;tbody&gt;
								&lt;tr class="inner-body"&gt;
									&lt;td&gt;

										&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
											&lt;tbody&gt;
												&lt;tr class="header"&gt;
													&lt;td bgcolor="" class="container"&gt;

														&lt;table width="100%"&gt;
															&lt;tbody&gt;
																&lt;tr&gt;
																	&lt;td class="container"&gt;



																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding: 0px;"&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div style="text-align: center;"&gt;
																											&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/1E_s2eM0f4H9SpXwfgfSCkMFmLc0wOzRqDlfOO4jMvQ=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
																											|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/bmd0cmcONf7opUXUqhK0UgQCZecSNEBVA15JUMCBiAs=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=5f66765e-acf2-11f1-b868-5fe56e0d2d5e%26pt=campaign%26t=1789046546%26s=77ed5fb4e3ae0774068a420a9a7ee1eafe87f349dee75a97a9be15cfeb4b56f0/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/0PJUJSkmSVlk-J2F6zQjyIAQMrR0HoQRSwRdKB_viDk=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
																											&lt;br&gt;
																											&lt;/span&gt;&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
																										&lt;br&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;br&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr id="together-with"&gt;
																									&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
																										&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%3Fd=7013y000002A9FfAAK%26nc=701ed00000DLbbyAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FfAAK_english_df-2026_header_dreamforce_starts_5/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/yJp5oMCTsiv6bS9HAh0vNIUcCb_7SY_v__TzH-vQGOI=452"&gt;&lt;img src="https://images.tldr.tech/salesforce.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Salesforce"&gt;&lt;/a&gt;&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;


																						&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
																										&lt;div style="text-align: center;"&gt;

																											&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-10&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr id="sponsy-copy"&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%3Fd=7013y000002A9FfAAK%26nc=701ed00000DLbbyAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FfAAK_english_df-2026_header_dreamforce_starts_5/2/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/2tQJv9svTeZLhgLwO5dj1TUQCxfXWSFVUL57vvL6iYA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Dreamforce starts in 5 days. Stream it all live, for free (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    From accelerating vulnerability detection to creating observability headaches, AI is putting security teams to the test. That's why protecting data, governing AI agents, and building securely at scale are core focuses at Dreamforce.&lt;p&gt;&lt;/p&gt;&lt;p&gt;The &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%2Fsecurity-keynote%253A-trust-across-agents_-data_-and-platforms-2%3Fd=7013y000002A9FdAAK%26nc=701ed00000DLbbwAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FdAAK_english_df-2026_Body_security_keynote/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/d34zDCHZHw3V126L_k6Y7oHdT6fuGLS0RmHR4fih7Sc=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;Security Keynote&lt;/span&gt;&lt;/a&gt; lays out how to outpace evolving threats and accelerate AI with trust, visibility, and guardrails. Then, the &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%2Faiforce-keynote%253A-anywhere-humans-and-agents-work%3Fd=7013y000002A9FeAAK%26nc=701ed00000DLbbxAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FeAAK_english_df-2026_Body_aiforce_keynote/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/08o_cjInaalhoC-8isjUcmx7l1My_mIywRTmCm8Bbj0=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;AIforce Keynote&lt;/span&gt;&lt;/a&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%2Faiforce-keynote%253A-anywhere-humans-and-agents-work%3Fd=7013y000002A9FeAAK%26nc=701ed00000DLbbxAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FeAAK_english_df-2026_Body_aiforce_keynote/2/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/DG8--lYfWA01uwoVjIFIDZ3nthXnhj6A7n9SiApVWUI=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt; &lt;/span&gt;&lt;/a&gt;will break down how business logic and governance can power intelligent experiences everywhere.&lt;/p&gt;

																											&lt;p&gt;&lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.salesforce.com%2Fplus%2Fexperience%2Fdreamforce_2026%3Fd=7013y000002A9FfAAK%26nc=701ed00000DLbbyAAD%26utm_source=tldr%26utm_medium=display%26utm_campaign=amer_us_cross-cloud_cross-industry%26utm_content=cross-segment_pg-mtp_7013y000002A9FfAAK_english_df-2026_cta_register/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/wkD3usCXWXZLcl2ZaKTFWi8MgwWh52erjtoO8nG8NK4=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;Register for free&lt;/span&gt;&lt;/a&gt; to stream Dreamforce live on Salesforce+.


																											&lt;/p&gt;
																											&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;
																																											&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;
																	&lt;/td&gt;
																&lt;/tr&gt;
															&lt;/tbody&gt;
														&lt;/table&gt;
													&lt;/td&gt;
												&lt;/tr&gt;
												&lt;tr bgcolor=""&gt;
													&lt;td class="container"&gt;

														&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
															&lt;tbody&gt;
																&lt;tr&gt;
																	&lt;td style="padding: 0px;"&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.talosintelligence.com%2Fclearfake-webdav-infection-chain%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/X7rP3oWCCFtFPNIC1IXxyP9QiduHds_5HyW6IJgFUik=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;ClearFake WebDAV Infection Chain Delivers Amatera Stealer, ZigCryptoStealer, and NetSupport Manager (17 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Cisco Talos identified two WebDAV-based infection chains delivering the Amatera Stealer to facilitate untargeted credential and cryptocurrency theft. The initial chain executed a DLL named "verification.google" at a Ukrainian government organization. A parallel "pf.ch" chain used ClearFake JavaScript stored on the BNB Smart Chain, alongside a fake Google CAPTCHA ClickFix prompt, to task secondary payloads, including ZigCryptoStealer and NetSupport Manager.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.csoonline.com%2Farticle%2F4219626%2Fadobe-commerce-max-severity-bug-comes-under-active-attack.html%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/aVUbUn8jvFhLwRulaj42dEVo0kzV5y-L2RzJjScCTek=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Adobe Commerce max-severity bug comes under active attack (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Threat actors are actively exploiting CVE-2026-75650, a max-severity unauthenticated code execution vulnerability dubbed StyleSmuggler, to compromise online stores running Adobe Commerce and Magento Open Source. Exploitation began on September 4, with the deployment of a Rust backdoor and a separate PHP web shell. Adobe released emergency hotfix VULN-393411 to address the flaw, prompting Sansec to warn that patching alone is insufficient for stores that may already be compromised.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F71WP8g/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/Xn4ptjSlSEZjf1seDOePQdHfJcxcuu7mXYAAszfV9P8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;SAP Warns of Maximum Severity OVERPASS Kernel Vulnerability (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    German software company SAP has released an update that patches 20 security vulnerabilities. Of particular note is a maximum-severity buffer overflow vulnerability in the External Passport Protocol (EPP) processing library, which could allow an unprivileged attacker to run arbitrary commands as an administrator. Another missing authentication vulnerability in the SAP NetWeaver Message Server could allow unauthenticated attackers to execute malicious payloads and arbitrary commands across the full SAP system cluster.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcloud.google.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Ffrom-prompting-to-autonomy-the-evolution-of-adversarial-ai%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/Qv1e6bgKCC4A1Sf2GMKFIn0G_spPw9zSVR8JJiSlad4=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI (22 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Google's GTIG reports that threat actors have graduated from basic prompting to agentic AI workflows that autonomously manage scanning pipelines, resolve errors, and execute multi-stage attacks with minimal human oversight, compressing response windows from days to hours. For instance, groups like UNC6780 exploit the AI supply chain by stealing GitHub Actions tokens to sign malicious packages by tricking LLMs, state-sponsored groups use AI across the full attack lifecycle from reconnaissance to post-exploitation, and financially motivated actors built credential-harvesting agents that stole thousands of secrets in under six hours using only AI coding tools and markdown playbooks.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.ox.security%2Fblog%2Fcve-2026-82533-deepseek-harness-ai-agent-sandbox-escape%2F%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/k6XmfTC7xQOsiE1SL_8G3EwtBWfCQrnaVf9Okp4m7EY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox (6 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    CVE-2026-82533 affects DeepSeek Harness 0.1.1-rc.2 and earlier. Its local API trusted the client-controlled Host header instead of the peer address. Sandboxed sessions retained loopback access and could call that API to enable danger-full-access with approvals disabled. A single shell command escaped the sandbox on default settings. If port 3080 was forwarded or tunneled, unauthenticated remote attackers could control sessions and export stored conversations. DeepSeek fixed the issue in 0.1.2-alpha.1.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Funit42.paloaltonetworks.com%2Fppi-network-malware-campaign-analysis%2F%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/WyrZJsN97Bb_UoUupxg0J9X8Pqk73o75WjTh8iKOB0M=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure (14 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Unit 42 traced two routine-looking adware infections to CL-CRI-1171, a pay-per-install operation that has run for two years behind a shared loader called OfferLoader, delivering payloads through 11 gaming-optimization YouTube channels and an SEO-poisoning funnel into corporate and government endpoints. The loader gates delivery on a Base64 click_id fingerprint of OS, browser, referrer, search keyword, and IP, so scanners and analysts get a decoy download page while real victims get the payload, which explains the near-zero public footprint despite 10,000+ loader samples and 200+ rotating domains. Defenders should stop triaging commodity loader alerts as low priority and pivot on loader C2 infrastructure instead, since a single OfferLoader run here spawned three unrelated campaigns including a cross-platform Insomnia RAT, a steganography-delivered WebSocket tunneler, and a Chrome Secure Preferences bypass.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.datadoghq.com%2Fresources%2Fai-security-best-practices%2F%3Futm_source=tldrnewsletter%26utm_medium=newsletter%26utm_campaign=dg-content-ebook-aisecuritybestpractices-security-app-ww-en-701vy00000v709wyar-tldr-infosec-secondary-091026/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/Dy2PfpIE90mclYCMYq_ScAB2QQDuDICsZaTHCs_L_z4=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Your team is using AI. Help them secure it with Datadog's guide (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Cybersecurity was already a mess before AI. Now it's harder than ever to keep up. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.datadoghq.com%2Fresources%2Fai-security-best-practices%2F%3Futm_source=tldrnewsletter%26utm_medium=newsletter%26utm_campaign=dg-content-ebook-aisecuritybestpractices-security-app-ww-en-701vy00000v709wyar-tldr-infosec-secondary-091026/2/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/omXD9But9NR3yd_7tGkPKjR1jBtL1IN_q-fJtLvSKD0=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;This Datadog guide&lt;/span&gt;&lt;/a&gt; lays out how AI works, its entry points and business logic, and the underlying components that host and run LLM apps. It also provides tactical steps you can take to improve AI security today. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.datadoghq.com%2Fresources%2Fai-security-best-practices%2F%3Futm_source=tldrnewsletter%26utm_medium=newsletter%26utm_campaign=dg-content-ebook-aisecuritybestpractices-security-app-ww-en-701vy00000v709wyar-tldr-infosec-secondary-091026/3/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/tr4CA0Bd9EAKfUkp2jK0_fcp3v5s16YkqDJzJ5DkLvI=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Get the guide&lt;/span&gt;&lt;/a&gt;
																											&lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fkontext-security%2Fkontext%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/x8GRmZv-lAJ2W5XhRR7c146TfyuF9UDblZUjC2IwX34=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Kontext (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Kontext puts local policy between AI agents and the tools they call. It observes supported actions, evaluates policy before consequential actions run, and records the decision and outcome in an authorization ledger.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcymphony.io%2F%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/KxkaNddNxN6SRUq6nTjzCUtVLa5bXpgmYjOP2JwiTh4=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Cymphony (Product Launch)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Cymphony maps employee and machine identities, their system access, and sensitive data exposure. It detects risky permissions, investigates incidents, prioritizes fixes, and automates access corrections.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FCloud-Architekt%2FAzurePrivilegedIAM%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/C3CDKdL9QpQQ6Cbxcrnr8Xw5nF_6SZzVoxWnhIPVJps=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Privileged Identity and Access in Microsoft Entra (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A collection of docs, resources, and samples for implementing secure, privileged IAM in Microsoft Azure and Entra.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpostquantum.com%2Fpost-quantum%2Fionq-secp256k1-resource-estimate%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/PbJtzd4ylxZ9rJLMiFbDndF4xT7Eupl1KMUen1BSEmM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;IonQ Compiles Shor's Attack on secp256k1 Down to 19,397 Ions and 26 Days per Attempt (21 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    IonQ published a blueprint estimating that 19,397 physical qubits and 1,457 logical qubits are required to break 256-bit elliptic-curve signatures and compromise dependent systems. The proposed attack uses the Walking Cat architecture to solve the secp256k1 discrete logarithm problem with about 39 million Toffoli gates over an estimated 25.7 days per attempt. IonQ describes this as the first fully compiled, fault-tolerant resource estimate for this attack and notes that the required machine does not currently exist and that the estimated scale aligns with its 2028 technology roadmap.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fnovee.security%2Fblog%2Fgemini-cli-pre-task-rce%2F%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/hWQh1wMHYSPjxhkrKtYCdRIOs4FPnogF9A9khkISPSA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Pre-Task RCE in Google Gemini CLI (CVE-2026-12537) (10 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Novee researchers disclosed a CVSS 10.0 pre-task RCE in Gemini CLI where GEMINI_SANDBOX_PROXY_COMMAND in .gemini/.env reached a host shell via spawn(..., { shell: true }) before the sandbox even started, exposing all parent process secrets (GITHUB_TOKEN, GEMINI_API_KEY) and bypassing four defensive layers. The same pre-task execution pattern appeared in Claude Code (execution before the trust dialog) and Codex (MCP auto-launch before the model), revealing a shared architectural blind spot: workspace configuration influences process authority before model-time guardrails activate. The exploit required no prompt injection—three lines in a configuration file were sufficient for host-level code execution.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F09%2F08%2Flg-accused-of-egregious-invasion-of-privacy-over-tv-data-collection%2F5294956%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/kaIZhmyWajT0bIV27stn0dulGDORIvrKmzng-jbQB-c=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;LG accused of 'egregious invasion of privacy' over TV data collection (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Gamers Nexus found LG TVs allegedly recording audio after voice features were enabled, including during standby. Tests reportedly uncovered plaintext transcripts, IP addresses, location data, nearby Wi‑Fi details, and local-device inventories. The team also alleged offline audio capture and a possible remote-code-execution flaw. LG denied ambient recording and said ACR advertising use requires opt-in consent.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F9FFTnq/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/jQieQzcBTz9hD1C2Mo0OYMz1Uc7yRtGSfys23ooGFCk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Hackers Return $263 Million Stolen From Liquid Network (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    White-hat hackers drained ~$320 million from Liquid Network's federation wallet over the weekend.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.404media.co%2Ffirst-take-it-down-act-sentencing-case%2F%3Futm_source=tldrinfosec/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/bEdsJtR5v_5po4uY2-jswT9p2lAd_JBYqFKGuXO-LMw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;First 'Take It Down Act' Sentencing Puts Man Behind Bars for 15 Years (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Ohio man James Strahler received the first Take It Down Act conviction, with a 15-year sentence for distributing 3,000+ real and AI-generated child sexual abuse images and cyberstalking victims.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		
																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Love TLDR? Tell your friends and get rewards!
																						&lt;/p&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
																						&lt;div class="text-block"&gt;
																							Share your referral link below with friends to get free TLDR swag!
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="padding: 10px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/rYPpzMj0WyHUzHZ83Wd-u0DgEbi2nulEP9dFtMHc_c0=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="padding:5px 10px;"&gt;
																						&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/EofP7Wkh6Ydxip98TXlK_JSZxPtesaeisKv_mU9VujE=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		


																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Want to advertise in TLDR? 📰
																						&lt;/p&gt;
																						&lt;div class="text-block" style="margin-top: 10px;"&gt;
																							If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/fGEEOe716uVYW2IXnlFGlSJGAtahD-7I2gwF-LInX3Q=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
																						&lt;/div&gt;
																						&lt;br&gt;

																						&lt;!-- New "Want to work at TLDR?" section --&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Want to work at TLDR? 💼
																						&lt;/p&gt;
																						&lt;div class="text-block" style="margin-top: 10px;"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/P4_MpNYuQV7b0WdxXuFu0cpvgItO1Vs2xbMamGyWUlw=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/EqRceb-VhsKx6vXZO8eO6Y9DMuUsSonkkXmldvMr0Cw=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/bO_6D4Y4TwS0iMp5HdYqJZSVMVDMUPvKFvH4-AdV8tI=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
																						&lt;/div&gt;
																						&lt;br&gt;

																						&lt;div class="text-block"&gt;
																							If you have any comments or feedback, just respond to this email!
																							&lt;br&gt;
																							&lt;br&gt; Thanks for reading,
																							&lt;br&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/I_ZK5UtZBwLVregjBq6TXHQ8vsHNBDSpeoXl1v2iiG4=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/VU-Oxgl5H5p_w_sIMDDMGIwgQ-nnJtFZLeEKxCj4qc4=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/boIXIG66dg2MogDQvGdKagRZMzL556w8TqSDmP-KpFI=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
																							&lt;br&gt;
																							&lt;br&gt;
																						&lt;/div&gt;
																						&lt;br&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding: 15px 15px;"&gt;
																						&lt;div class="text-block" id="testing-id"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/_n8wDB7KLxEFB9mXqqGALur043Tl3A-kNQRUc1tX95w=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=5f66765e-acf2-11f1-b868-5fe56e0d2d5e%26pt=campaign%26pv=5%26spa=1789045291%26t=1789046546%26s=b6a0f0ce3a87041cd2f14df2e9243d275252639d7b5f5e4b40ccd7e1b57da334/1/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/tOtuoHKGQJmRiBf6aKo1asdFAoJw2QwEKmBflaCqzIw=452"&gt;unsubscribe&lt;/a&gt;.
																							&lt;br&gt;

																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																	&lt;/td&gt;
																&lt;/tr&gt;
															&lt;/tbody&gt;
														&lt;/table&gt;
													&lt;/td&gt;
												&lt;/tr&gt;
											&lt;/tbody&gt;
										&lt;/table&gt;
									&lt;/td&gt;
								&lt;/tr&gt;
							&lt;/tbody&gt;
						&lt;/table&gt;
					&lt;/td&gt;
				&lt;/tr&gt;
			&lt;/tbody&gt;
		&lt;/table&gt;



	

&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a08b7be04c-af2c483e-7748-41dc-857c-6f909fd49b2f-000000/Wv5zbJzx-aTl9XeYfoa0yXyO32rZnfA4K1HrY6FiDAU=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
