<!DOCTYPE html><html lang="en"><head><meta http-equiv="Content-Type" content="text/html charset=UTF-8"><meta charset="UTF-8"><meta name="viewport" content="width=device-width"><meta name="x-apple-disable-message-reformatting"><title>TLDR InfoSec</title><meta name="color-scheme" content="light dark"><meta name="supported-color-schemes" content="light dark"><style type="text/css">
:root {
color-scheme: light dark; supported-color-schemes: light dark;
}
*,
*:after,
*:before {
-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
}
* {
-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
}
html,
body,
.document {
width: 100% !important; height: 100% !important; margin: 0; padding: 0;
}
body {
-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
}
div[style*="margin: 16px 0"] {
margin: 0 !important;
}
table,
td {
mso-table-lspace: 0pt; mso-table-rspace: 0pt;
}
table {
border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
}
img {
-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
}
*[x-apple-data-detectors] {
color: inherit !important; text-decoration: none !important;
}
.x-gmail-data-detectors,
.x-gmail-data-detectors *,
.aBn {
border-bottom: 0 !important; cursor: default !important;
}
.btn {
-webkit-transition: all 200ms ease; transition: all 200ms ease;
}
.btn:hover {
background-color: #f67575; border-color: #f67575;
}
* {
font-family: Arial, Helvetica, sans-serif; font-size: 18px;
}
@media screen and (max-width: 600px) {
.container {
width: 100%; margin: auto;
}
.stack {
display: block!important; width: 100%!important; max-width: 100%!important;
}
.btn {
display: block; width: 100%; text-align: center;
}
}
body,
p,
td,
tr,
.body,
table,
h1,
h2,
h3,
h4,
h5,
h6,
div,
span {
background-color: #FEFEFE !important; color: #010101 !important;
}
@media (prefers-color-scheme: dark) {
body,
p,
td,
tr,
.body,
table,
h1,
h2,
h3,
h4,
h5,
h6,
div,
span {
background-color: #27292D !important; color: #FEFEFE !important;
}
}
a {
color: inherit !important; text-decoration: underline !important;
}
</style><!--[if mso | ie]>
<style type="text/css">
a {
background-color: #FEFEFE !important; color: #010101 !important;
}
@media (prefers-color-scheme: dark) {
a {
background-color: #27292D !important; color: #FEFEFE !important;
}
}
</style>
<![endif]--></head><body class="">
<div style="display: none; max-height: 0px; overflow: hidden;">ShadowLeak is a zero-click vulnerability in OpenAI's ChatGPT Deep Research agent that utilized invisible, indirect prompt injection commands </div>
<div style="display: none; max-height: 0px; overflow: hidden;">
<br>
</div>
<table align="center" class="document"><tbody><tr><td valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"><tbody><tr class="inner-body"><td>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr class="header"><td bgcolor="" class="container">
<table width="100%"><tbody><tr><td class="container">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"><tbody><tr><td style="padding: 0px;">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div style="text-align: center;">
<span style="margin-right: 0px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/ljwrNykYuvyfbMBs7b1n-O0QHG_8Ohjzrh-x8rw_ngs=424" rel="noopener noreferrer" target="_blank"><span>Sign Up</span></a>
|<span style="margin-right: 2px; margin-left: 2px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/0Bj27k9F0GoiRrRNMl58euzJLsRhLCnLlH_H2bRD7a8=424" rel="noopener noreferrer" target="_blank"><span>Advertise</span></a></span>|<span style="margin-left: 2px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=ad04d2ac-9934-11f0-bb5a-dbca188214a6%26pt=campaign%26t=1758719228%26s=b0994dc55d574346acb2771815eaead8a5f639acaf29cdf70c154ff23c5ea8ad/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/lorotZ7-qnl3cpfaQUVmhrX8EZ-Gy9K1yime3viBbpk=424"><span>View Online</span></a></span>
<br>
</span></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="text-align: center;"><span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;">T</span><span style="font-size: 30px;"><span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;">L</span><span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;">D</span></span><span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;">R</span>
<br>
</td></tr></tbody></table>
<br>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr id="together-with"><td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"><strong style="vertical-align:middle !important; height: 100%;">Together With </strong>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Flp%2Ftldr%3Futm_source=tldr%26utm_medium=email%26utm_campaign=Cy25-09-camp-platform-global-prospect-iis-x-tldr_newsletter_0924/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/3D_35Njs-NFxyjK60aWcIzWoNyJKDBgAZF8k8Ik7DlA=424"><img src="https://images.tldr.tech/huntress.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Huntress"></a></td></tr></tbody></table>
<table style="table-layout: fixed; width:100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;">
<div style="text-align: center;">
<h1><strong>TLDR Information Security <span id="date">2025-09-24</span></strong></h1>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width:100%;" width="100%"><tbody><tr id="sponsy-copy"><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Flp%2Ftldr%3Futm_source=tldr%26utm_medium=email%26utm_campaign=Cy25-09-camp-platform-global-prospect-iis-x-tldr_newsletter_0924/2/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/Pr4VBrTm432ZCQNMszdqg8Mdu5hvsJkmgFZZ6ttLxxM=424">
<span>
<strong>Why are big security vendors ignoring 99% of companies? (Sponsor)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
It's not because cybersecurity is only a problem for Fortune 500s. It's because these vendors' business models are built on selling multi-million dollar enterprise licenses. But it doesn't have to be this way.<p></p><p>With cybercrime hitting businesses of all sizes and industries, <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Flp%2Ftldr%3Futm_source=tldr%26utm_medium=email%26utm_campaign=Cy25-09-camp-platform-global-prospect-iis-x-tldr_newsletter_0924/3/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/kHYSR-bxy_TZBdUg1j-6okIgpQZbC8J8wtEI44Kfq88=424" rel="noopener noreferrer nofollow" target="_blank"><span>Huntress</span></a> delivers security for the 99%.</p>
<p>The <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Flp%2Ftldr%3Futm_source=tldr%26utm_medium=email%26utm_campaign=Cy25-09-camp-platform-global-prospect-iis-x-tldr_newsletter_0924/4/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/6a3mOuh0kRlx60SByN19TS7wwRojmUqFGIayZkPbbPw=424" rel="noopener noreferrer nofollow" target="_blank"><span>Huntress Managed Platform</span></a> is custom-built security for endpoints, identities, people, and more, all managed for you 24/7, at a startup-friendly budget. And they'll deliver results like:</p>
<p>✅ 8-min MTTR (EDR) </p>
<p>✅ 3-min MTTR (ITDR) </p>
<p>✅ <1% false positives</p>
<p>✅ 98.8% global CSAT score</p>
<p>Wreck hackers, not your security budget.</p>
<p>Rated 4.9/5 on G2.</p>
<p><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Flp%2Ftldr%3Futm_source=tldr%26utm_medium=email%26utm_campaign=Cy25-09-camp-platform-global-prospect-iis-x-tldr_newsletter_0924/5/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/SWTsrvSleM2RyhWkTlUElXybbeuE5Ta7i1Z_ovzzoJ0=424" rel="noopener noreferrer nofollow" target="_blank"><span>Schedule a demo to learn more</span></a>
</p>
</span></span></div>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr>
<tr bgcolor=""><td class="container">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td style="padding: 0px;">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🔓</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Attacks & Vulnerabilities</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhackread.com%2Fshadowleak-exploit-exposed-gmail-data-chatgpt-agent%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/oVuzcuejXWkrr4OyVJAX8nuIKvCb3n62dioQXM06cyg=424">
<span>
<strong>ShadowLeak Exploit Exposed Gmail Data Through ChatGPT Agent (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
ShadowLeak is a zero-click vulnerability in OpenAI's ChatGPT Deep Research agent that utilized invisible, indirect prompt injection commands hidden in emails to exfiltrate Gmail data without user knowledge. The attack operated entirely on OpenAI's servers using the agent's browser.open() function call to send stolen data encoded in Base64 to attacker-controlled URLs, achieving a 100% success rate. OpenAI fixed the vulnerability in August after receiving a responsible disclosure, but researchers warn that the technique could also be used on other connected services, such as Google Drive, Microsoft Teams, and GitHub.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Flastpass-fake-password-managers-infect-mac-users-with-malware%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/d35BoF4FMmN43cTph1oTLlqoSHGOUl9QIpoIWQs4bzY=424">
<span>
<strong>LastPass: Fake Password Managers Infect Mac Users With Malware (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
There is a malware campaign that uses GitHub repositories to deliver fraudulent password managers. The fake software delivers the Atomic (AMOS) InfoStealer to infected macOS devices. LastPass says that aside from its product, over 100 different softwares are being used, such as 1Password and Notion.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.securityweek.com%2Fpatch-bypassed-for-supermicro-vulnerability-allowing-bmc-hack%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/5sqxBoXW4F6_jNQKOVarsP7PKIK6lTOGpFpUa55XBgY=424">
<span>
<strong>Patch Bypassed for Supermicro Vulnerability Allowing BMC Hack (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Binarly researchers found they could bypass Supermicro's patch for CVE-2024-10237, a firmware flaw allowing malicious updates, prompting a new CVE (CVE-2025-7937) and fix. They also discovered CVE-2025-6198, a flaw that bypasses the Root of Trust. Both enable attackers to control the BMC and OS. These flaws show firmware validation's fragility, risking persistent BMC code execution with major enterprise security implications.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🧠</span></div>
</div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Strategies & Tactics</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.pepperclipp.com%2Fpepperclipp-public%2Fa-tag-to-rule-them-all-using-aws-tags-to-enumerate-cloud-resources%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/7ZQNbBLzFkJYT2-qE6epu9pR18eAppEI_1_oyAWtIlo=424">
<span>
<strong>A Tag to Rule Them All: Using AWS Tags to Enumerate Cloud Resources (10 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
AWS tags offer a way to attach metadata to a resource, either automatically (like the Name tag) or manually. Several services provide API calls such as ListTags or GetTags, enabling efficient enumeration of resources accessible by an identity. TagNabIt is a tool designed for tag-based brute-force enumeration.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.synacktiv.com%2Fen%2Fpublications%2Fexploring-grapheneos-secure-allocator-hardened-malloc%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/XOnAJB8-4o59kTJKgsniYL-3GdFfs-JFzdXgYgmH7c4=424">
<span>
<strong>Exploring GrapheneOS secure allocator: Hardened Malloc (22 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
GrapheneOS features a hardened malloc, a memory allocator that uses ARM Memory Tagging Extension (MTE) to assign tags to memory regions and detect corruption, effectively preventing heap overflows and use-after-free attacks. Its two-stage quarantine system, which involves randomized and FIFO queues, makes exploiting freed memory difficult by requiring attackers to perform thousands of free operations. Large allocations are secured through guard pages, address space randomization, and the separation of metadata from user data, all of which enhance security.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.ncsc.gov.uk%2Fguidance%2Fexternal-attack-surface-management-buyers-guide%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/6E5hZVR3nEpc1YaTkTDKKBmGfhBzleijNGyYgnHGOpg=424">
<span>
<strong>External attack surface management (EASM) buyer's guide (11 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
External Attack Surface Management (EASM) tools automate the discovery and continuous monitoring of internet-facing assets, providing organizations with an attacker's perspective of their vulnerabilities across domains, IP addresses, and exposed services. The strategic value lies in combining automated asset discovery with risk prioritization—EASM products excel at identifying shadow IT, abandoned subdomains, and misconfigurations that traditional internal scanning misses. Organizations should select EASM solutions based on their specific needs: small businesses require clear remediation guidance, SMEs need robust subdomain discovery to prevent takeovers, and enterprises benefit from large-scale IP scanning with export capabilities for distributed security teams.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🧑💻</span></div>
</div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Launches & Tools</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdiscover.securecodewarrior.com%2FTrust-Agent-AI-Waitlist.html%3Futm_source=tldr%26utm_medium=email%26utm_campaign=2025-09-trust-agent-ai-global-en-dg/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/2aapFXyg-sAMR4QKXhVjbFrhqO9dBcHqQA0XHaEkzHA=424">
<span>
<strong>Control AI in your SDLC (Sponsor)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
78% of developers use AI coding tools, yet half of functionally correct AI-generated code is insecure. <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdiscover.securecodewarrior.com%2FTrust-Agent-AI-Waitlist.html%3Futm_source=tldr%26utm_medium=email%26utm_campaign=2025-09-trust-agent-ai-global-en-dg/2/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/hBJrYVXEWsY1g-SyCaQ851JsDQWzZL7drZ6aVtcUG18=424" rel="noopener noreferrer nofollow" target="_blank"><span>SCW Trust Agent: AI</span></a> gives leaders visibility and governance to manage this risk - spotting “shadow AI,” mapping vulnerabilities to skill level, and enforcing policy. <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdiscover.securecodewarrior.com%2FTrust-Agent-AI-Waitlist.html%3Futm_source=tldr%26utm_medium=email%26utm_campaign=2025-09-trust-agent-ai-global-en-dg/3/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/qFvfxrgeXkKObCW-9wcW-YMkpnakQRMdNdShXg_ezXE=424" rel="noopener noreferrer nofollow" target="_blank"><span>Be among the first to join the early access waitlist!</span></a>
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FMHaggis%2FMSIXBuilder%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/V2c18UYMzXclTkaDswvQytRlHpbrOhEwEcY0xafhXRU=424">
<span>
<strong>MSIXBuilder (GitHub Repo)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
MSIXBuilder is a PowerShell tool for creating MSIX packages with embedded test applications.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Falbertan017%2FLLM4Decompile%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/I3a2oCz5GBSlvtDgLN-WRYlzzLgDGMIMFNDFEP16lpM=424">
<span>
<strong>LLM4Decompile (GitHub Repo)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
LLM4Decompile is an open-source LLM dedicated to decompilation.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Ffirezone%2Ffirezone%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/TRrc-eEvzW_RCXoJ3m59r--Uh4udgEraPInQ7kO0Hl8=424">
<span>
<strong>Firezone (GitHub Repo)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Firezone is an open source platform for secure remote access, suitable for organizations of any size. Unlike most VPNs, it uses a granular, least-privileged approach with group-based policies to control access to applications, subnets, and more.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🎁</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><strong><h1>Miscellaneous</h1></strong></div>
</div>
</td></tr></tbody></table>
<table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Famerican-archive-of-public-broadcasting-fixes-bug-exposing-restricted-media%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/mHpgFOGEHhN2KZZ17pzos6-RDiGAVscKPG1_0xR5i2U=424">
<span>
<strong>American Archive of Public Broadcasting fixes bug exposing restricted media (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
A vulnerability in the American Archive of Public Broadcasting website, which has been exploited since at least 2021, allowed unauthorized downloading of protected and private media through an insecure direct object reference (IDOR) flaw that bypassed access controls by manipulating media ID parameters. The exploit circulated in Discord preservation communities and "data hoarder" groups, leading to leaks of protected content, including a banned Sesame Street episode featuring the Wicked Witch of the West. AAPB fixed the vulnerability within 48 hours after being notified. The extent of accessed content during the years-long exploitation remains unknown.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.secretservice.gov%2Fnewsroom%2Freleases%2F2025%2F09%2Fus-secret-service-dismantles-imminent-telecommunications-threat-new-york%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/BH7VLq8iTy5oRdfpG5rdLtU0nrk5mEUa0Ze7p1iWBYQ=424">
<span>
<strong>U.S. Secret Service dismantles imminent telecommunications threat in New York tristate area (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
The US Secret Service (USSS) dismantled a network of over 300 co-located SIM servers and 100,000 SIM cards positioned within 35 miles of the UN General Assembly in New York that were used to conduct telecommunications-related threats against senior US government officials. The devices were capable of performing multiple attack vectors, including disabling cell phone towers, facilitating denial of service attacks, and enabling anonymous encrypted communications between nation-state threat actors and criminal enterprises. Early forensic analysis revealed cellular communications between nation-state threat actors and individuals known to federal law enforcement, representing an imminent threat to protective operations during the high-profile international gathering.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fengineering.cmu.edu%2Fnews-events%2Fnews%2F2025%2F07%2F24-when-llms-autonomously-attack.html%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/XYmUkJuaMB1fj8iU_WETJRGSsRflmxZgIVKC98etU34=424">
<span>
<strong>When LLMs Autonomously Attack (5 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
A researcher at Carnegie Mellon University demonstrated that an LLM can coordinate a system of agents to recreate real-world attacks. As part of his PhD, Brian Singer recreated the network environment of the 2017 Equifax data breach and observed that an LLM could replicate the attack. These capabilities allow smaller organizations to use LLMs as dedicated red teamers.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">⚡</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Quick Links</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmicrosoft-removes-windows-11-safeguard-hold-after-fixing-face-detection-bug%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/5_liDD6t2P17BGLnk3TYAFB770KdlSI7FtJiFo5j8mk=424">
<span>
<strong>Microsoft lifts Windows 11 update block after face detection fix (1 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Microsoft has removed a compatibility hold that prevented devices with integrated cameras from installing Windows 11 24H2 due to a face detection bug that caused app freezes when using the Camera app, Windows Hello facial recognition, and other camera-utilizing applications.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhackread.com%2Fmi6-dark-web-portal-silent-courier-russia-secrets%2F%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/3kkDUl0aDnnhivfvyMRfcyP3PoZRwvcUM2ZACSrttzo=424">
<span>
<strong>MI6 Opens Dark Web Portal "Silent Courier" for Russians to Share Secrets (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
MI6 launched a dark web portal called Silent Courier to allow potential agents worldwide, particularly Russians, to securely share sensitive information about terrorism and hostile intelligence activities.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theverge.com%2Fnews%2F782993%2Fsteam-blockblasters-crypto-scam-malware%3Futm_source=tldrinfosec/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/TcCw7WFUSArs-El8h_ZI7bjMEJY_pfOVOPNWgMYdWWY=424">
<span>
<strong>Steam game removed after cryptostealer takes over $150K (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Steam removed the free-to-play game BlockBlasters after malware stole over $150,000 in cryptocurrency from players, including $32,000 from a Latvian streamer with stage 4 cancer raising funds.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;">
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Love TLDR? Tell your friends and get rewards!
</p>
</td></tr>
<tr><td class="container" style="padding: 0px 10px 15px;">
<div class="text-block">
Share your referral link below with friends to get free TLDR swag!
</div>
</td></tr>
<tr><td align="left" style="padding: 10px;">
<div class="text-block">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/OQaqe41yQfCa9HVi4fa8m-to9Vm6Jloyrlj-4zeGREg=424" style="color: #464ba4; text-decoration: underline;">https://refer.tldr.tech/78de0e20/8</a>
</div>
</td></tr>
<tr></tr>
<tr><td align="left" style="padding:5px 10px;">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/vuBaMJREDAgsVm7lFw9awjk189eRXIPUyywztrCODnc=424" style="font-size: 16px; line-height: 1.6; padding: 10px 0; display: inline-block; text-decoration: underline;"><span style="mso-text-raise:13pt; text-decoration: underline;">Track your referrals here.</span></a>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;">
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Want to advertise in TLDR? 📰
</p>
<div class="text-block" style="margin-top: 10px;">
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/cwdvhg4Un1Iap9y8zfl1h-IM14lS74EYUjO9z_5fiUo=424"><strong><span>advertise with us</span></strong></a>.
</div>
<br>
<!-- New "Want to work at TLDR?" section -->
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Want to work at TLDR? 💼
</p>
<div class="text-block" style="margin-top: 10px;">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/BypBPLaj0B0VhA5T5Nt-gUY1YrgUHnEpVzo1CRBEDBo=424" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"><strong>Apply here</strong></a> or send a friend's resume to <a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;">jobs@tldr.tech</a> and get $1k if we hire them!
</div>
<br>
<div class="text-block">
If you have any comments or feedback, just respond to this email!
<br>
<br> Thanks for reading,
<br>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/LubJqw7L4ZuL6wF5DBNCMN2_bMT9uYa5yworwQedSko=424"><span>Prasanna Gautam</span></a>, <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/NvQtfrcvu38JVzFTWzH78yc8X2Sz_LqIXJ01mqjxbc0=424"><span>Eric Fernandez</span></a> & <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/ekGWWbmGsiFnXYdSjocIzY2tdNihnIQHzMwIgF7gPNw=424"><span>Sammy Tbeile</span></a>
<br>
<br>
</div>
<br>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block" id="testing-id">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/_iMmgCUH1NE9WL6FrY-mnkAdFfEjQWi0QVIHWOwxBVo=424">Manage your subscriptions</a> to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=ad04d2ac-9934-11f0-bb5a-dbca188214a6%26pt=campaign%26pv=4%26spa=1758718919%26t=1758719228%26s=69fdde6c02156c3cde5ceb733a18c796f1c9cf65f90dffa21d358aee6eb78c56/1/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/_qorDHjhz5DPY_hZ03K117EyDzStUyLeB8hMKZ2KSSw=424">unsubscribe</a>.
<br>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
<img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001997bd5ba2c-ccdbeaca-ac71-4aeb-adbc-b678709d69ed-000000/wTKm_7m80QHZRUzXqcOYTCiyfjB-No1Sbj0nIZHrpiI=424" style="display: none; width: 1px; height: 1px;">
</body></html>