<!DOCTYPE html><html lang="en"><head><meta http-equiv="Content-Type" content="text/html charset=UTF-8"><meta charset="UTF-8"><meta name="viewport" content="width=device-width"><meta name="x-apple-disable-message-reformatting"><title>TLDR InfoSec</title><meta name="color-scheme" content="light dark"><meta name="supported-color-schemes" content="light dark"><style type="text/css">
:root {
color-scheme: light dark; supported-color-schemes: light dark;
}
*,
*:after,
*:before {
-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
}
* {
-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
}
html,
body,
.document {
width: 100% !important; height: 100% !important; margin: 0; padding: 0;
}
body {
-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
}
div[style*="margin: 16px 0"] {
margin: 0 !important;
}
table,
td {
mso-table-lspace: 0pt; mso-table-rspace: 0pt;
}
table {
border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
}
img {
-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
}
*[x-apple-data-detectors] {
color: inherit !important; text-decoration: none !important;
}
.x-gmail-data-detectors,
.x-gmail-data-detectors *,
.aBn {
border-bottom: 0 !important; cursor: default !important;
}
.btn {
-webkit-transition: all 200ms ease; transition: all 200ms ease;
}
.btn:hover {
background-color: #f67575; border-color: #f67575;
}
* {
font-family: Arial, Helvetica, sans-serif; font-size: 18px;
}
@media screen and (max-width: 600px) {
.container {
width: 100%; margin: auto;
}
.stack {
display: block!important; width: 100%!important; max-width: 100%!important;
}
.btn {
display: block; width: 100%; text-align: center;
}
}
body,
p,
td,
tr,
.body,
table,
h1,
h2,
h3,
h4,
h5,
h6,
div,
span {
background-color: #FEFEFE !important; color: #010101 !important;
}
@media (prefers-color-scheme: dark) {
body,
p,
td,
tr,
.body,
table,
h1,
h2,
h3,
h4,
h5,
h6,
div,
span {
background-color: #27292D !important; color: #FEFEFE !important;
}
}
a {
color: inherit !important; text-decoration: underline !important;
}
</style><!--[if mso | ie]>
<style type="text/css">
a {
background-color: #FEFEFE !important; color: #010101 !important;
}
@media (prefers-color-scheme: dark) {
a {
background-color: #27292D !important; color: #FEFEFE !important;
}
}
</style>
<![endif]--></head><body class="">
<div style="display: none; max-height: 0px; overflow: hidden;">Hackers accessed the Pierce County Library System’s network and stole data from more than 340,000 patrons, employees, and their family members </div>
<div style="display: none; max-height: 0px; overflow: hidden;">
<br>
</div>
<table align="center" class="document"><tbody><tr><td valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"><tbody><tr class="inner-body"><td>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr class="header"><td bgcolor="" class="container">
<table width="100%"><tbody><tr><td class="container">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"><tbody><tr><td style="padding: 0px;">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div style="text-align: center;">
<span style="margin-right: 0px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/-z75Sxde1wRqd9ghpzXWG_F7dQBQaLL44tp-O7ZlQWc=435" rel="noopener noreferrer" target="_blank"><span>Sign Up</span></a>
|<span style="margin-right: 2px; margin-left: 2px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/B9q6ds4y_LXyf8XG13YQQtFxBChzSJQRdnzWaYw9qVk=435" rel="noopener noreferrer" target="_blank"><span>Advertise</span></a></span>|<span style="margin-left: 2px;"><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=e17710b0-d744-11f0-b391-dbb2e38de8f7%26pt=campaign%26t=1765548487%26s=aebe069969f05ea742350dec5862dd6c7cf36da3605e17849fdaca51b7be934d/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/inb_v2VYa9JJvO7TXrBsxdhgYURLzwQmOtL300zNerw=435"><span>View Online</span></a></span>
<br>
</span></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="text-align: center;"><span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;">T</span><span style="font-size: 30px;"><span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;">L</span><span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;">D</span></span><span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;">R</span>
<br>
</td></tr></tbody></table>
<br>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr id="together-with"><td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"><strong style="vertical-align:middle !important; height: 100%;">Together With </strong>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fztw.com%2F/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/p8tlK_evnlKEUvRJ7QTFtu8dX0rzWtEhcUL4S8SxVfg=435"><img src="https://images.tldr.tech/threatlocker3.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="ThreatLocker"></a></td></tr></tbody></table>
<table style="table-layout: fixed; width:100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;">
<div style="text-align: center;">
<h1><strong>TLDR Information Security <span id="date">2025-12-12</span></strong></h1>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width:100%;" width="100%"><tbody><tr id="sponsy-copy"><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fztw.com%2F/2/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/woiq6eaOkdWDDbDH1iKNsyjQ23mWX2y2qQUO-NbaWDY=435">
<span>
<strong>Special offer for TLDR readers: $200 off Zero Trust World 2026 with code ZTWTLDR26 (Sponsor)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
ThreatLocker's annual <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fztw.com%2F/3/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/7Bpuaw2_XWu2bcJFvaPKI1BthhJmpSCqrPZBAK7u2eg=435" rel="noopener noreferrer nofollow" target="_blank"><span>Zero Trust World</span></a> is the most interactive, <strong>hands-on cybersecurity learning</strong> event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
<p></p>
<p>👀 TLDR readers get <strong>$200 off all-access registration</strong>. That's <strong>33% less than the list price</strong>. </p>
<p>🎓 Registration includes all sessions and labs (including CPE eligible sessions!) </p>
<p>🍹At <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fztw.com%2F/4/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/XcXPls5YFRgxP5WbD48NTQy96LiHtzjGJKutdFCyYXs=435" rel="noopener noreferrer nofollow" target="_blank"><span>Zero Trust World</span></a>, all access really means all access, so meals and the afterparty are included with each pass. </p>
<p>Use code <strong>ZTWTLDR26</strong> for <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fztw.com%2F/5/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/YUqsBaAp52kMA3q7ZsiQJsh4kzPUoZzrwbWIGnmPW1A=435" rel="noopener noreferrer nofollow" target="_blank"><span>$200 off your all-access pass</span></a>
</p>
</span></span></div>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr>
<tr bgcolor=""><td class="container">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td style="padding: 0px;">
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🔓</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Attacks & Vulnerabilities</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.securityweek.com%2Fpierce-county-library-data-breach-impacts-340000%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/b_eI8BjgAdPpccyZgFSvJn-O1TdlTgntn7L409cSWIQ=435">
<span>
<strong>Pierce County Library Data Breach Impacts 340,000 (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Hackers accessed the Pierce County Library System's network in April and stole data from more than 340,000 patrons, employees, and their family members. Patron data includes names and dates of birth, while employee-related data also covers Social Security numbers, IDs, financial and health information.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftechcrunch.com%2F2025%2F12%2F11%2Fsecurity-flaws-in-freedom-chat-app-exposed-users-phone-numbers-and-pins%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/jKbygyn_8j4wBd6UIGzTujteVLWf7L8MgbLo_rS1O88=435">
<span>
<strong>Security flaws in Freedom Chat app exposed users' phone numbers and PINs (3 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Two major flaws in Freedom Chat have been discovered: one allowed attackers to enumerate nearly 2,000 users' phone numbers by mass-guessing them against the app's servers, and another leaked users' PIN codes to everyone in the default public channel via backend responses. Freedom Chat reset all PINs, tightened rate limiting, removed exposed numbers, and shipped an updated version. This is founder Tanner Haas' second messaging app to face serious security issues.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FP4wbcM/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/lPbzR43dFZBK0OcxmszFRFhYWq2hydQEhFn8mrKizZM=435">
<span>
<strong>New OpenAI Models Likely Pose “High” Cybersecurity Risk (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
OpenAI has stated that the cybersecurity capabilities of its frontier models are accelerating rapidly and that upcoming models are likely to pose a “high” risk. OpenAI notes that in August, GPT-5 scored 27% on a CTF, whereas last month GPT-5.1-Codex-Max scored 76%. OpenAI's Fouad Martin points to the models' ability to work for extended periods as a driving force behind this.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🧠</span></div>
</div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Strategies & Tactics</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.kaspersky.com%2Fblog%2Fshare-chatgpt-chat-clickfix-macos-amos-infostealer%2F54928%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/cDbgqEnbto_hLCdQ1ekR0GU3ZNWen2ntRz6c0chXpCI=435">
<span>
<strong>Infostealer has entered the chat (7 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Criminals are exploiting interest in OpenAI's Atlas browser by buying Google ads that point to a shared ChatGPT conversation posing as an installation guide for a macOS “Atlas browser.” The guide instructs users to run a one‑line Terminal command that silently downloads a script, steals credentials, and deploys the AMOS infostealer, which exfiltrates browser data, crypto‑wallet info, documents, and more, while also installing a backdoor for persistent remote access.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2F1password.com%2Fblog%2Fsecuring-mcp-servers-with-1password-stop-credential-exposure-in-your-agent%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/kMRg_OReWh8F2F5YCUlrmzuxTytqMl1uPabVw0PUPMM=435">
<span>
<strong>Securing MCP Servers With 1Password (3 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
MCP (Model Context Protocol) server configurations used by AI development tools like Cursor and Claude Code typically store plaintext API keys in mcp.json files, creating a risk of credential exposure when repositories are pushed to version control or shared with teammates. Developers can eliminate this risk by storing secrets in 1Password vaults, referencing them using op://vault/item/field syntax in .env files, and launching MCP servers with the 1Password CLI command op run --env-file=.env to dynamically inject credentials at runtime without persisting them on disk. This pattern ensures secrets are decrypted only in memory during process execution and automatically disappear when the process exits, preventing accidental exposure in Git history while maintaining developer productivity.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fslayer0x.github.io%2Fawscli%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/YyOX7NOz70LYia7Ekzs7RU7cgmN9Yq6Ed1M3rMBrAcY=435">
<span>
<strong>Weaponizing the AWS CLI for Persistence (5 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
The AWS CLI allows users to define command aliases that can run arbitrary bash commands. A limitation that previous work faced when trying to abuse aliases was that if an attacker overwrote a command (such as `aws sts`) with a malicious alias, they could not call the original command. This post introduces a one-liner that dynamically modifies the alias file to restore the original command so it can be used in the malicious alias and then restores the malicious alias after running.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🧑💻</span></div>
</div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Launches & Tools</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fspecterops.io%2Fso-con%2F%3Futm_source=newsletter%26utm_medium=TLDR%26utm_campaign=TLDR_So_Con%26utm_id=contentsyndicationlatest_campaign%26utm_content=TLDR1/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/iNU0aZnggGlWvpr7DjI8k0Ak1ynDrEOMfDt6Jars9lk=435">
<span>
<strong>Where Identity Security Meets Community (Sponsor)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fspecterops.io%2Fso-con%2F%3Futm_source=newsletter%26utm_medium=TLDR%26utm_campaign=TLDR_So_Con%26utm_id=contentsyndicationlatest_campaign%26utm_content=TLDR1/2/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/1nwSgjTK_iztyo9p2rLHOSASuakKBZi0DryNqtMiWjw=435" rel="noopener noreferrer nofollow" target="_blank"><span>SO-CON 2026 (April 13-18, 2026)</span></a> is where the community comes together to advance the practice of Attack Path Management. We are excited to share that Kevin Mandia, Founder and Former CEO of Mandiant, will deliver the featured keynote at <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fspecterops.io%2Fso-con%2F%3Futm_source=newsletter%26utm_medium=TLDR%26utm_campaign=TLDR_So_Con%26utm_id=contentsyndicationlatest_campaign%26utm_content=TLDR1/3/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/miXkzq_0PA6Ayd1qZOA3NpyA7WoCKpts7kH3OdY20RE=435" rel="noopener" target="_blank"><span>SO-CON 2026</span></a>.
<br>
<br><a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fspecterops.io%2Fso-con%2F%3Futm_source=newsletter%26utm_medium=TLDR%26utm_campaign=TLDR_So_Con%26utm_id=contentsyndicationlatest_campaign%26utm_content=TLDR1/4/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/GeaP8D6KBgrNKZASmgFdbdsZ1dlrigCch8I8cAKE1oI=435" rel="noopener noreferrer nofollow" target="_blank"><span>Secure your spot today!</span></a>
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.primesec.ai%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/wGCLB9gA6yIMCI55pDpXvAPqC3fH5H379uEIMuULODs=435">
<span>
<strong>Prima Security (Product Launch)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Prime Security (Prima) provides an AI-powered “agentic security architect” that autonomously performs design-stage security reviews across planned development work, continuously identifying, prioritizing, and helping mitigate software design flaws so security teams can focus on higher-level architecture strategy.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FTencent%2FAI-Infra-Guard%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/8IVGxZyKoBLvPmFGd1fjnt5Oz9M4Vp8M8V2fKmFlVVk=435">
<span>
<strong>AI Infra Guard (GitHub Repo)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
AI Infra Guard integrates capabilities such as AI infra vulnerability scan, MCP Server risk scan, and Jailbreak Evaluation to provide users with the most comprehensive, intelligent, and user-friendly solution for AI security risk self-examination.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fgadievron%2Fraptor%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/dEfJhB4vvRUIiXRNuv0Nb4lhr8rvpZldqO0BX79Jyv0=435">
<span>
<strong>RAPTOR (GitHub Repo)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
RAPTOR is an autonomous offensive/defensive security research framework built on Claude Code.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">🎁</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><strong><h1>Miscellaneous</h1></strong></div>
</div>
</td></tr></tbody></table>
<table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2F2025%2F12%2F11%2Fdocker_hub_secrets_leak%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/h63HCEdfoRJYADcVLltfAtudgblPveIWQDQKfzKx9wA=435">
<span>
<strong>10K Docker images spray live cloud creds across the internet (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Flare's research reveals that over 10,000 public Docker Hub images expose active secrets from more than 100 organizations, including a Fortune 500 company and a major bank, often via personal or “shadow IT” accounts. These images leak API keys and other live credentials for cloud, CI/CD, and AI services, and even when secrets are removed from images, about three-quarters of the underlying keys remain valid, leaving organizations open to compromise.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FFzNqqI/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/IHfweBlVoDT_vtL5UglLONSbyx6SQXpxaNzB_2DzNdQ=435">
<span>
<strong>Copilot's No-Code AI Agents Liable to Leak Company Data (3 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Nontechnical employees can quickly build Copilot Studio agents that connect to sensitive systems, but these bots are easily tricked into ignoring security instructions, leaking customer data, and even modifying records such as trip costs. Tenable's experiment with a travel-booking bot shows how simple prompt injections expose credit card details and abuse edit permissions.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.hacklore.org%2Fletter%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/d-GJWv3Klg3N7qIn2s0jhWnz1OQOCP3i5uTMsguJ3sE=435">
<span>
<strong>Stop Hacklore: An Open Letter (4 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
A group of current and former CISOs, security leaders, and practitioners has released an open letter urging the public, employers, journalists, and policymakers to stop spreading outdated security recommendations. Specifically, they cited: avoid public WiFi, never scan QR codes, never charge devices from public USB ports, turn off Bluetooth and NFC, regularly clear cookies, and regularly change passwords as outdated advice. Instead, they recommend focusing on reminding the public to keep critical devices and applications updated, enabling MFA, and using strong passphrases and password managers.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;"><span style="font-size: 36px;">⚡</span></div></div>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding-top: 0px; padding-bottom: 0px;">
<div class="text-block">
<div style="text-align: center;">
<h1><strong>Quick Links</strong></h1>
</div>
</div>
</td></tr></tbody></table>
<table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"><tbody><tr><td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top">
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fresource.cobalt.io%2Fgigaom-radar-report-for-ptaas-2025%3Futm_campaign=28200064-GigaOm%2520Radar%2520Report%25202025%26utm_source=TLDR%26utm_medium=enewsletter/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/QLuL0I16HNdlMc9doD3sxvTwTvroyDxXd_wTiXrpimk=435">
<span>
<strong>GigaOm's 2025 Radar Report for for Penetration Testing as a Service: Cobalt named a leader (Sponsor)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
The 2025 GigaOm PTaaS Radar Report confirms traditional, periodic testing is no longer adequate protection. Read it for an expert framework for evaluating 16 leading PTaaS vendors. <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fresource.cobalt.io%2Fgigaom-radar-report-for-ptaas-2025%3Futm_campaign=28200064-GigaOm%2520Radar%2520Report%25202025%26utm_source=TLDR%26utm_medium=enewsletter/2/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/wjaOaxnZvLgSwDZcfHeX35_B7OaVGg4uG_V187Dq8NQ=435" rel="noopener noreferrer nofollow" target="_blank"><span>Get the report</span></a>
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmicrosoft-bounty-program-now-includes-any-flaw-impacting-its-services%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/1qd0JocxRR8M4YCRRwuwg05tSgr8SmfbAkQERf46Opo=435">
<span>
<strong>Microsoft Bounty Program Now Includes Any Flaw Impacting Its Services (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
Microsoft has announced an expansion of its bug bounty program to include any Microsoft service and third-party service that impacts Microsoft and doesn't offer its own bug bounty program.
</span>
</span>
</div>
</td></tr></tbody></table>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block">
<span>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fuk-fines-lastpass-over-2022-data-breach-impacting-16-million-users%2F%3Futm_source=tldrinfosec/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/EgwEqNXOwPGCw7HohNPp3FzWJiyQ4bh4-ogNuDt-aLw=435">
<span>
<strong>UK Fines LastPass Over 2022 Data Breach Impacting 1.6M Users (2 minute read)</strong>
</span>
</a>
<br>
<br>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, Verdana, sans-serif;">
The UK's Information Commissioner's Office (ICO) fined LastPass £1.2M over failing to implement security measures that could have prevented the 2022 data breach.
</span>
</span>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;">
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Love TLDR? Tell your friends and get rewards!
</p>
</td></tr>
<tr><td class="container" style="padding: 0px 10px 15px;">
<div class="text-block">
Share your referral link below with friends to get free TLDR swag!
</div>
</td></tr>
<tr><td align="left" style="padding: 10px;">
<div class="text-block">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/3bvWkP_bpF4Hk1_ImRAfXwZ40YHjefJoD_RkKKY9prc=435" style="color: #464ba4; text-decoration: underline;">https://refer.tldr.tech/78de0e20/8</a>
</div>
</td></tr>
<tr></tr>
<tr><td align="left" style="padding:5px 10px;">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/jWJvmDMKRN-TKf-vCihWNoKl31K5Y76LFtnvkIodGX8=435" style="font-size: 16px; line-height: 1.6; padding: 10px 0; display: inline-block; text-decoration: underline;"><span style="mso-text-raise:13pt; text-decoration: underline;">Track your referrals here.</span></a>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;">
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Want to advertise in TLDR? 📰
</p>
<div class="text-block" style="margin-top: 10px;">
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/sSwTegCWdluSFwd-Hu5zfmQcFVY9hkkuJKLrzsty7vw=435"><strong><span>advertise with us</span></strong></a>.
</div>
<br>
<!-- New "Want to work at TLDR?" section -->
<p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;">
Want to work at TLDR? 💼
</p>
<div class="text-block" style="margin-top: 10px;">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/0BvhhVaaoCoIkL7WdfZDS9SMotrDO8m-tZoJiVm1TmM=435" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"><strong>Apply here</strong></a>,
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/pUpHUq1F6TmU-NO_QSRBrQNdNdARBgHGhE_Q830Evy8=435" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"><strong>create your own role</strong></a> or send a friend's resume to <a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;">jobs@tldr.tech</a> and get $1k if we hire them! TLDR is one of <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/PXanrVD95zOu24nMwCjmHnDCAjIONnjr6KcWEvuvwfM=435" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"><strong>Inc.'s Best Bootstrapped businesses</strong></a> of 2025.
</div>
<br>
<div class="text-block">
If you have any comments or feedback, just respond to this email!
<br>
<br> Thanks for reading,
<br>
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/tsGtdplWmsUDgkj2FteX9ppdOOXltLO9vZxtVdI_ab0=435"><span>Prasanna Gautam</span></a>, <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/PUGDlAYRggS6ByYK0LiImfi4rvUgFCLVYKbhq3sNgTg=435"><span>Eric Fernandez</span></a> & <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/OAMX7rW855iMaLu3MipyPZtIELvVw9NKE2C0qG4_STA=435"><span>Sammy Tbeile</span></a>
<br>
<br>
</div>
<br>
</td></tr></tbody></table>
<table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"><tbody><tr><td class="container" style="padding: 15px 15px;">
<div class="text-block" id="testing-id">
<a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/0UDfQNvid_E-glj2OYBLVP3ztF1_KzZ88HG46yQiVAo=435">Manage your subscriptions</a> to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please <a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=e17710b0-d744-11f0-b391-dbb2e38de8f7%26pt=campaign%26pv=4%26spa=1765548187%26t=1765548487%26s=519d2726f51607501d6f4099abdb0f974e6527786d25fdd49af41a0e97784552/1/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/hlUcqVXnyugPsU5FTwqamKOYDMX3oZOFHx7lFGcs9yw=435">unsubscribe</a>.
<br>
</div>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr></tbody></table>
<img alt="" src="http://tracking.tldrnewsletter.com/CI0/0100019b12e3f41b-2c6755e3-a522-44b9-9c68-5e273896d3bf-000000/SoyeOJnoU4MnVc4bq_HL6UnVJBALHuhugMLNt0FJoiA=435" style="display: none; width: 1px; height: 1px;">
</body></html>