Email: WeChat 0-click worm 🐛, Hacking Customer Service AI agents 🤖, Biggest Microsoft Patch Tuesday 🪟

Subject:
WeChat 0-click worm 🐛, Hacking Customer Service AI agents 🤖, Biggest Microsoft Patch Tuesday 🪟
Received:
9/9/2026, 1:09:18 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;



&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;Calif has demonstrated a worm that takes over a WeChat account via an unanswered VoIP call, then uses that account to call the victim&#039;s contacts&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/1-ckGJF2KMnSELN6hHU1QvDD941jpovsAMbL1_vTRoc=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/eypycwJn3G8dX-EEDZhUPoP1Bk20Fd2H4lmjMpx04dM=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=31e80af2-ac0d-11f1-8e8c-65c9d88d2e0a%26pt=campaign%26t=1788959358%26s=f9591e301d95821f3976fdda10ecddd3a3909dcb89c62053a22e82ea99e9e771/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/ZrsER01eAKLuJxR5Oy8KE2h9zd3Y259C9vFhBECdGyo=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_source=tldr%26utm_medium=email%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_primary_header_think_like_attacker/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/kZCWlLDz16mbo8mHbjxcqvLLmkDN8vUd4oKw9sL3mrg=452"&gt;&lt;img src="https://images.tldr.tech/flexential.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Flexential"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-09&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_source=tldr%26utm_medium=email%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_primary_header_think_like_attacker/2/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/yyOa5lzTaZPGqhoW0Cu9AmYYsGEkC8iMjHdai9KkUPU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Think like an attacker. Prepare like a defender.&nbsp;(Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    What do cybercriminals look for before they strike? Former FBI Special Agent Jeff Lanza and Flexential VP of Cybersecurity Services Will Bass share lessons from real-world cases in &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_source=tldr%26utm_medium=email%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_primary_Body_outsmarting_cybercrime_lessons_fbi/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/okp7cD81T3b7uiEq9AGBAbs7NU6_4Lp5hEIbEKLmy7g=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;Outsmarting cybercrime: Lessons from an FBI insider&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_source=tldr%26utm_medium=email%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_primary_Body_outsmarting_cybercrime_lessons_fbi/2/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/F098vwfEE69L0OUXu_wSK5VmGPu7PwMyiRsenrO7gSc=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;.&lt;/span&gt;&lt;/a&gt; Learn how attackers identify vulnerabilities, exploit human behavior, and gain a foothold, plus get practical insights for reducing risk, strengthening cyber resilience, and preparing your organization to respond and recover when prevention isn't enough.&nbsp;
&lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcalif.io%2Fresearch%2Fweworm%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/AWr7m-6WxAl-l0_HOdNEY6PTSQFe5dtS2XzqLsVrhm8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;WeWorm (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Calif has demonstrated a zero-click worm that takes over a WeChat account via an unanswered VoIP call, then uses that account to call the victim's contacts. This exploit relies on a memory corruption bug in WeChat's VoIP stack and requires the attacker to be on the victim's friend list, which is a weak barrier since one compromised friend can lead to further exploitation. Tencent has mitigated this issue in server-side updates and in client versions Android 8.0.77 and iOS 8.0.76, so users should enforce these updates and reconsider trusted-contact privileges in messaging apps.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FNEF1Xc/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/1iS3W_6PW2P3Eo-GCColj-xIooyn8nwbFJond2lIYlw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;220M Traveler Records Exposed in Vietnam-Linked APIS Leak (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Security researchers gained access to an Elasticsearch cluster containing an Advanced Passenger Information System (APIS) database with records belonging to 220M passengers and flight crew members. The researchers received a 401 when trying to access the cluster via the public internet but could reach the database, which accepted default credentials via a cloud-based access path. The data includes passengers' and crew members' names, dates of birth, sex, nationalities, passport or travel document numbers, document expiration dates, and issuing countries.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FIvoITh/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/KCPNmoZB4IcioLGY9kT3AfbMbYWqxrXXcgkQKyLOUr0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Hackers Breach F5 BIG-IP APM Devices to Deploy Linux Rootkit (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    There is a malware campaign targeting F5 BIG-IP APM devices that exploits a critical RCE vulnerability and injects a fileless web shell. A distinct installer deploys the payload by infecting the Apache executable and modifying SELinux configurations. ESET researchers identified the malware as PoisonedRefresh.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.intigriti.com%2Fresearchers%2Fblog%2Fhacking-tools%2Fhacking-ai-customer-service-agents%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/3w9O-sgiv9Iktg5L_Cf8MVi-vpnUCXTc6XVWKnP1h78=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Hacking AI customer service agents (11 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Researchers demonstrated attacks against customer-support agents through email spoofing, duplicate From headers, out-of-office replies, and email-address parser mismatches. These flaws can trigger profile changes, refunds, phishing emails, or account data disclosure. Alternatively, other paths reset OTP rate limits, abuse IVR checks, and steal third-party reset codes from monitored support inboxes. Hidden instructions in alternate MIME parts, CSS-hidden text, and attacker-controlled images can mislead automated processing. Untrusted forum comments and namespace-controlled sitemap pages can also poison support knowledge bases.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frfd.shared.oxide.computer%2Frfd%2F0301%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/qR9Vq3ZHHpcR4PBthTGsqoBZSnnh3CtbFT9DLCngtbM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;RFD 301: Has anybody seen my keys?: A key-hierarchy strategy for rack-level security (12 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Oxide published its internal design for protecting rack data at rest, rooting everything in a Shamir-shared rack secret that no attacker can recover without stealing at least K sleds or M.2 drives. Per-drive ZFS wrapper keys are derived with HKDF using SHA3-256 and an info string built from the PCI vendor ID, drive model, and serial number, so compromising one disk key leaves the others intact. The harder problem is rotation across a distributed two-phase commit: the dealer encrypts the epoch N-1 rack secret under a key derived from the epoch N secret using chacha20poly1305, keeping the old secret unrecoverable until the new configuration commits.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fresearch.checkpoint.com%2F2026%2Fthe-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt%2F%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/63bQnjkmDIRbRtlPwQpus7xdie_I6frr1m0GbC1D6x8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT (10 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Check Point Research discovered that ChatGPT code-execution containers from different accounts were using package metadata as a covert cross-account channel because these containers could read and write item properties on the same internal JFrog Artifactory instance. This allowed attackers to deliver a planted instruction through a shared conversation, a custom GPT, or a pasted prompt. The model would then run a hidden second task stream in the same turn, pulling data from the victim's connected Gmail while the visible answer stayed clean. Although OpenAI has decommissioned that Artifactory instance, defenders should enable per-session isolation for any mutable state in shared internal services and review default low-risk reads configuration.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FNovaCode37%2FPrism-platform%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/6xtRGv8vPL_DMJKXBMC82GGduddMWUZlmNlArD8I-Lg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Prism-platform (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    All-in-one OSINT platform — 22+ modules, AI analysis, real-time dashboard, and OPSEC scoring. Scan domains, IPs, emails, phones, and usernames.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fgendigitalinc%2Fsage%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/S0i8nwgjxqC5Hl99_DR8xl4LXfMkw7QwitNi3CdIzSs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Sage (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Sage is a security tool from Gen Digital that intercepts tool calls made by AI coding assistants and blocks dangerous ones before they execute. It features URL reputation checks against a cloud service, 300+ local YAML heuristics for risky commands and credential exposure, and two-tier prompt injection detection combining heuristics with a fine-tuned ML model. Sage is supported in many harnesses like Claude Code, Cursor, VS Code, OpenClaw, and OpenCode, with npm or marketplace installs per platform.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdecbench.com%2F%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/XBnqrRNQiKupU17-zX5b2S20Nk7x0M3qvPqZVgMhti0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;DecBench (Website)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    DecBench is a living benchmark from Noelo Lab at the University of Georgia that scores decompilers and LLMs on exact source recovery. It measures perfect-match percentage across datasets covering control flow structure, type recovery, and recompilability, with new tools added to the leaderboard as they ship.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fmicrosoft-365-attackers-use-help-desk.html%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/VLMCc2nApjwDLbYt8ZZiGU75tf4jMhwgyB_fDWVWXU0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    PREY-0058 targets executives through fake IT help-desk calls and authentication-themed domains. Its AitM pages capture Microsoft 365 credentials, MFA approvals, and session tokens. Operators replay tokens through residential proxies, then enumerate SharePoint and Entra ID. They bulk-exfiltrate SharePoint, OneDrive, Exchange, and Box data before issuing extortion demands. Defenders are advised to watch for proxy token replay, mailbox harvesting, and new MFA-themed domains.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F09%2F07%2Fuk-food-supply-chain-at-risk-from-hostile-attacks%2F5294719%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/upkO__qs3CY8V5-Vcr4YU2i4IpCf92nwajubT92Y4gg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;UK food supply chain at risk from hostile attacks (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The National Audit Office named cyberattacks as a threat to the UK food supply chain. Marks &amp; Spencer estimates its April 2025 attack cost £136 million after warehouse systems were disconnected, and the Co-op confirmed theft of 6.5 million member records. Several food supply chain organizations cited the substantial investments businesses are making to manage the threat and incidence of cyber-attacks.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflaviocopes.com%2Fpasskeys-webauthn%2F%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/Gn6g27J02MIFfm4Q_-gTi-BBOuquSu5P3FRQfaPsDwk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Passkeys and WebAuthn explained (8 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    This walkthrough covers passkey registration and login end-to-end, from server-issued challenges and stored public keys to SimpleWebAuthn verification in Node. Phishing resistance comes from RP ID scoping, which browsers enforce, but servers must still verify alongside exact origin, challenge freshness, and user verification. Teams tend to underestimate single-use challenges, concurrent login tabs, credential management screens, and recovery paths that end up weaker than the login they back up.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_medium=email%26utm_source=tldr%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_quick-link/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/R1JM8xZhjIUIKRb5-rtIsEZAdXijmVkZ4fSePiesxm0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Think like an attacker. Prepare like a defender. (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Learn how cybercriminals identify vulnerabilities, exploit human behavior, and gain a foothold in &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_medium=email%26utm_source=tldr%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_quick-link/2/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/5fsm8tL4iMZpxlCBtVnvImZFVpsqiaNV_OM3JCoxSEQ=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;Outsmarting cybercrime: Lessons from an FBI insider&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;, with practical insights for strengthening cyber resilience.&nbsp;&lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.flexential.com%2Fresources%2Febook%2Foutsmarting-cybercrime-lessons-fbi-insider%3Futm_medium=email%26utm_source=tldr%26utm_campaign=data-protection%26utm_content=q3-26_outsmarting-cybercrime-lessons-fbi-insider_quick-link/3/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/bstqvyMEUQkpFIIlYD4UfXr1ShSkw6m25K8M9WW2a0U=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;Get the Ebook&lt;/span&gt;&lt;/a&gt;
&lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theguardian.com%2Fbusiness%2F2026%2Fsep%2F07%2Fgrindr-settle-uk-lawsuit-dating-app-ad%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/0iecl-WXm8uwuP2zQIZxtavgZSGBdzCkggDX4lOaY-c=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Grindr pays £26m to settle UK lawsuit over allegedly sharing users' HIV status (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Grindr agreed to pay £26m to settle a UK privacy claim involving 12,000 users as the suit alleged pre-2020 sharing of sensitive data, including HIV status, with advertising firms.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.scworld.com%2Fbrief%2Fnew-android-rat-uses-worm-to-target-exposed-adb-services%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/T58hBB-xv0avSkmAxDjQQy6r8zYjP61hpEaoE7OUnA8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;New Android RAT uses worm to target exposed ADB services (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Dark Atlas has documented THost9, an Android RAT whose worm component scans for internet-exposed ADB services and authenticates with prepared keys to install itself, giving operators shell access, file transfer, and tunneling on affected phones and Redroid containers.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fkrebsonsecurity.com%2F2026%2F09%2Fmicrosoft-plugs-nearly-1000-security-holes%2F%3Futm_source=tldrinfosec/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/hF61iZreFmZC5aazg-UiHgguRLAwXuKeRBAYpgAsNIo=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Microsoft Plugs Nearly 1,000 Security Holes (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Microsoft has released 974 patches, its largest batch ever, including two actively exploited privilege-escalation zero-days and 113 critical vulnerabilities.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/9auT_wCtSTz4saVH4T4VC3BplHAgsuykiwHcKW5rETE=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/dwULWdwljzIJDqkqa9FGbEZuXb-fLc2koOpvprw2O08=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/Fxx5tpxWbcoDtX866YoT7dXWBMFbhM-HdLoQgmgtAws=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/aoKgUVe2mSmszmg66FMBrKxkn08R6EBa65Pzsdocc2o=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/A1ByGBMqD7Mfyhnk301k4HvWR96ozNl47RJa1bOL1d0=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/bGH5yMPAiLYvlouE0_LwQnnbciyextyf7uThlmkfQ58=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/mI7ni13cClBuCmyh6gEnARRWyf6iItu8Ev7lPLii_eo=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/KN3L7gNN2NZTbdvi5GJjAzaBo34UAp6tMjxmccMi750=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/0HqwUH3RcyEhc6V_4JuZlTJ4JWHWjS1uQCSX26epNKA=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/C9DjLUD1B19rUA44XGwoLuAeC-jsXCn3a-UpvkCzqx4=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=31e80af2-ac0d-11f1-8e8c-65c9d88d2e0a%26pt=campaign%26pv=5%26spa=1788958869%26t=1788959358%26s=987aee29deea078a46d07b2038fc52cc3b34d526aaaa41c25238a3d413000ced/1/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/OTEWb-Wo5jVCa5VMONwbwcQLfaoGSy28ohewd3UIFMM=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a086497ccd-b29417cc-119b-48e2-9b73-c1d680cab410-000000/b9dhMyxE5ysCLB-Z129Z4A7ZhwRg9W5jwYSdll8YV4I=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
