Email: Docker sandbox flaw 🐳 , WP Click2Shell RCE 🖱️ , Gemini AI breakout 🤖

Subject:
Docker sandbox flaw 🐳 , WP Click2Shell RCE 🖱️ , Gemini AI breakout 🤖
Received:
9/22/2026, 1:10:11 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;
		&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;
		&lt;meta charset="UTF-8"&gt;
		&lt;meta name="viewport" content="width=device-width"&gt;
		&lt;meta name="x-apple-disable-message-reformatting"&gt;
		&lt;title&gt;TLDR InfoSec&lt;/title&gt;
		&lt;meta name="color-scheme" content="light dark"&gt;
		&lt;meta name="supported-color-schemes" content="light dark"&gt;
		&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;
		&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;
	&lt;/head&gt;
	&lt;body class=""&gt;


		&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;Docker fixed CVE-2026-77179 in Sandboxes 0.42.0, which allowed malicious guest code on macOS to abuse virtio-fs symlink handling to access or&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
		&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
			&lt;br&gt;
		&lt;/div&gt;

		&lt;table align="center" class="document"&gt;
			&lt;tbody&gt;
				&lt;tr&gt;
					&lt;td valign="top"&gt;

						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;
							&lt;tbody&gt;
								&lt;tr class="inner-body"&gt;
									&lt;td&gt;

										&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
											&lt;tbody&gt;
												&lt;tr class="header"&gt;
													&lt;td bgcolor="" class="container"&gt;

														&lt;table width="100%"&gt;
															&lt;tbody&gt;
																&lt;tr&gt;
																	&lt;td class="container"&gt;



																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding: 0px;"&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div style="text-align: center;"&gt;
																											&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/2VgXUhe_DX-Ygv0r42Hfo89jkRvZiBLl_vhPbtbXYJg=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
																											|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/0_MMhJUNJUXuSESr6IZKYRAMnPmjJWMDS_Zx5ztXa7E=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=a486dff0-b669-11f1-b4e7-77ba7df85eec%26pt=campaign%26t=1790082611%26s=aee0593756d05023fdb29c8d8d894af672003f9e025e2c68376118b750009b9b/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/DW7ZU0dFnVegoL8qg-1_q_vYTKpFotQQFONo6WFpb70=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
																											&lt;br&gt;
																											&lt;/span&gt;&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
																										&lt;br&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;br&gt;

																						&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr id="together-with"&gt;
																									&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
																										&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.humansecurity.com%2Fcisos-guide-to-ai-agentic-traffic%2F%3Futm_source=tldr_infosec%26utm_medium=newsletter%26utm_campaign=brand_agentic_trust%26utm_content=cisos_guide_to_ai_agentic_traffic%26sp=4HSlFq6MLaizaeAbFOCN0XHK/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/sFNk_QUUp3XksJBtgRpsgGNN22F6LaLm-qkw3dsTXRo=452"&gt;&lt;img src="https://images.tldr.tech/human.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Human Security"&gt;&lt;/a&gt;&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;


																						&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
																										&lt;div style="text-align: center;"&gt;

																											&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-22&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr id="sponsy-copy"&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.humansecurity.com%2Fcisos-guide-to-ai-agentic-traffic%2F%3Futm_source=tldr_infosec%26utm_medium=newsletter%26utm_campaign=brand_agentic_trust%26utm_content=cisos_guide_to_ai_agentic_traffic%26sp=4HSlFq6MLaizaeAbFOCN0XHK/2/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/omEhsoVOuwt0wudD0eCLRGPhnWk4-CAK_yJYNrgaTgc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Blocking Every AI Agent Isn't a Security Strategy (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    AI agent traffic surged 7,851% over the last year, making legitimate AI activity increasingly difficult to distinguish from malicious automation.&lt;br&gt;&lt;br&gt;In traffic observed by HUMAN, &lt;strong&gt;just 0.5% of behavioral signals separated trusted AI assistants from malicious automation.&lt;/strong&gt; Block everything, and you disrupt legitimate users. Allow everything, and you create a new attack surface.&lt;br&gt;&lt;br&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.humansecurity.com%2Fcisos-guide-to-ai-agentic-traffic%2F%3Futm_source=tldr_infosec%26utm_medium=newsletter%26utm_campaign=brand_agentic_trust%26utm_content=cisos_guide_to_ai_agentic_traffic%26sp=4HSlFq6MLaizaeAbFOCN0XHK/3/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/OyoJFmEYNBe79FfDI1Pn5DvXCkfFxAO9pDryX6Dr3AY=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;The CISO's Guide to AI and Agentic Traffic&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;&lt;strong&gt; shows how to:&lt;/strong&gt;

																											&lt;p&gt;&lt;/p&gt;

																											&lt;p&gt;🔎 Distinguish legitimate AI activity from malicious automation.&lt;/p&gt;

																											&lt;p&gt;🛡️ Verify intent across browsing, accounts, and transactions.&lt;/p&gt;

																											&lt;p&gt;⚙️ Let trusted agents through while stopping real threats.
																												&lt;br&gt;
																												&lt;br&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.humansecurity.com%2Fcisos-guide-to-ai-agentic-traffic%2F%3Futm_source=tldr_infosec%26utm_medium=newsletter%26utm_campaign=brand_agentic_trust%26utm_content=cisos_guide_to_ai_agentic_traffic%26sp=4HSlFq6MLaizaeAbFOCN0XHK/4/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/-u5HzEdrqWc-KvsJMgHvNlkARYKMHekMx1RXWnlHSKc=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;Get the Guide&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;


																											&lt;/p&gt;
																											&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;
																																											&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;
																	&lt;/td&gt;
																&lt;/tr&gt;
															&lt;/tbody&gt;
														&lt;/table&gt;
													&lt;/td&gt;
												&lt;/tr&gt;
												&lt;tr bgcolor=""&gt;
													&lt;td class="container"&gt;

														&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
															&lt;tbody&gt;
																&lt;tr&gt;
																	&lt;td style="padding: 0px;"&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.infostealers.com%2Farticle%2Frevolut-hackers-used-infostealers-for-elaborate-social-engieering%2F%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/AuocR-oBa3mBCjb1S81MVxoYPMxE5a3xvOefrRtaZNI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Revolut Hackers Used Infostealers for Elaborate Social Engineering (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers reportedly used stolen Italian government webmail credentials to send fraudulent European Investigation Orders to Revolut Bank UAB. They added recovery addresses, monitored inboxes, deleted outbound messages, and removed replies as .eml files. Hudson Rock identified roughly 300 compromised pec.interno.it logins, suggesting attackers may have used existing infostealer logs.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fcritical-docker-sandboxes-flaw-lets.html%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/RMTyJvtUN04WXoFmhDc9Jd7aSogufLjJO7CsBJeu1Cs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Docker fixed CVE-2026-77179 in Sandboxes 0.42.0, which allowed malicious guest code on macOS to abuse virtio-fs symlink handling to access or modify host files as the VM monitor user. Version 0.42.0 also fixes CVE-2026-79994, a socket-relay race. Update to 0.42.0 or later ASAP.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcyberinsider.com%2Fwordpress-click2shell-flaw-enables-rce-after-one-admin-click%2F%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/zbGmzLQv3otdyFX04j3XiIIboUhCiqKQF_nFHkdBsHQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;WordPress Click2Shell flaw enables RCE after one admin click (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Click2Shell exploited an unsanitized theme slug passed into WordPress's admin panel jQuery selector, letting an attacker silently trigger theme installation using the logged-in administrator's own session token. When chained with a missing nonce/capability check in the Mobile Repair Zone 2.5.4 theme's AJAX handler, the flaw escalated to full RCE without the attacker needing any WordPress account. No CVE had been assigned at disclosure. Defenders should patch to WordPress 7.1.1 (or backports 7.0.5, 6.9.8, and 6.8.9) and set DISALLOW_FILE_MODS to block the installation stage entirely.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdarkmarc.substack.com%2Fp%2Fhijacking-ai-agents-how-an-agents%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/ypQ_kOd9sA6IOvWXst1FvqpY4cWUbFhiOpdh-ioeCnQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;AI Agent Goal Hijack: How Attackers Turn an Agent's Own Tools Against It (19 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers may plant instructions in pages, emails, calendar invites, code repositories, and agent messages, and Agents may treat that content as commands, then use existing tools and permissions. Cases include a Grok-linked wallet transfer, poisoned Nx packages that harvested developer secrets, and zero-click data theft through Microsoft 365 Copilot, ChatGPT Deep Research, Salesforce Agentforce, and GitHub Copilot. Limit tool permissions, require for high-impact actions, track goal changes, sanitize retrieved content, and test injected-goal scenarios.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frainpwn.blog%2Fblog%2Fuania-os-rce%2F%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/3PzDGAYJuutxjme_AK2yT7dSOZavr_K3ycWa7MD89rA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;UANIA OS: Authenticated Remote Code Execution (6 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The UaniaBOX admin panel gives no shell, only a web GUI. A researcher found that the packet capture download function let him swap the file path parameter to read /etc/passwd, then traced backend calls to an exposed OpenWrt UBUS JSON-RPC endpoint. ACLs blocked most writes except one: /etc/firewall.user, a root-run shell script triggered on firewall reload, where it allowed writing a command there and triggering a reload via the GUI executed code as root, confirmed by reading back uid=0. Affected versions are UaniaOS 2.1 through 3.0.0. It was fixed in 3.0.1. Vendor UANIA reproduced the bug, attributed it to excessive ACL permissions in their OpenWrt customization feeds, and patched it, though the MITRE CVE filing stalled for months due to a broken submission form.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fprojectzero.google%2F2026%2F09%2Fwindows-dangling-com.html%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/IMHRhdaoG0w2A0YxL1hSGCJE4uTB9mAs8Y1xAFKRgsg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Windows Exploitation Techniques: Dangling COM Object Registrations (7 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A Windows COM class stayed registered to a missing DLL in the user-writable ProgramData folder, letting any user plant code for a SYSTEM process to load (CVE-2026-66804, an incomplete fix for "Dark Elevator"). The exploit sent a custom-marshaled object pointing to the dangling CLSID to the Shell Create Object Handler, a SYSTEM COM server that ordinary users can start via a scheduled task and that allows custom marshaling. Defenders should patch, audit InProcServer32 registrations for DLLs that don't resolve in writable paths, and make sure privileged COM servers set EOAC_NO_CUSTOM_MARSHAL or the strong unmarshaling policy.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftigerbytecyber.us%2F%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/ub5ZIYfowr5O6dUpS15Gt3NNk0cyGKLSqzvoZt1UlOg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;TigerByte Cyber (Product Launch)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    TigerByte Cyber's Cyber Protection Suite hardens legacy and edge devices with data validation, packet inspection, network segmentation, and post-quantum encryption. It targets aircraft, drones, satellites, vehicles, and other mission-critical systems.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FRurixis%2FMSRKit%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/BAL_XcQeaee3Qji_SiRV04HhqFFuZFfx2-h9Nfazie0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;MSRKit (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    MSRKit is a Windows kernel exploitation library and CLI that hijacks IA32_LSTAR via a ROP chain through AmdTools64.sys to call arbitrary kernel functions and map unsigned drivers without HVCI. The ROP chain temporarily clears SMEP/SMAP in CR4, dispatches the target, then restores both CR4 and LSTAR cleanly before returning to user mode via sysretq. The library supports all Windows 10/11 builds and KPTI, but requires HVCI to be disabled. Concurrent callers across processes will BSOD.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FBert-JanP%2FEntraTrace%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/pj5hwyvIthneQDxB3hMCd9WgJgXCgP0uA_YBVRceWt8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;EntraTrace (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    EntraTrace is a defensive security research tool for documenting and identifying the observable behavior of offensive tooling targeting Microsoft Entra ID. The project builds an automated knowledge base on tools such as AzureHound, AADInternals, O365Enum, PingCastle, and others, focusing on the User-Agent and API artifacts they generate.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.firstpost.com%2Ftech%2Fhow-google-infiltrated-a-notorious-hacking-gang-with-an-undercover-analyst-report-14047160.html%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/DrHt6WPOZcyOswquMtKrcxgjziFJjwXAGLTRXwLLsOs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;How Google infiltrated a notorious hacking gang with an undercover analyst (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Google placed researcher Austin Larsen inside TeamPCP during its hacking campaign. He accessed a server holding stolen usernames, passwords, and access tokens. Google warned affected victims and disrupted credential abuse, and Larsen linked an alleged member to a Gmail account and Google Drive backups. Google shared evidence with the FBI, and the Australian police arrested the suspect a month later.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fedition.cnn.com%2F2026%2F09%2F19%2Fbusiness%2Fgemini-ai-hack-internet%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/I-vuEwZ2GRF4pAo1MYwPBEDafj_QPXR0ciPS6qlEzpU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Gemini hacked three companies in first known breakout by Google's AI (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    During a May security evaluation, Google's Gemini accessed three external websites after finding public information and trying credentials. One access came through password guessing. Two used credentials exposed in a public repository. Google said Gemini stopped in each case. Irregular notified the affected organizations and said it fixed its testing-process issues weeks later.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FewjnCW/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/wtHvQZHDwVWEClQud3QfLBpWDcZThH2uv1r1dn6Xv10=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;North Korean WaterPlum hackers infected 30,000 devices worldwide (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    WaterPlum (aka Contagious Interview) compromised 30,000+ devices across 100+ countries between December 2025 and July 2026, draining $10.7M from over 7,000 cryptocurrency wallets. A joint US, Japanese, Australian, and German advisory attributed the campaign to North Korea's 313 General Bureau and five malware families (BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle) delivered through fake technical interviews on recruiting platforms. North Korean IT workers later reused identity documents stolen from victims to fraudulently obtain jobs at Western companies.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;div style="text-align: center;"&gt;

																								&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
																							&lt;/div&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.brighttalk.com%2Fwebcast%2F18282%2F670427%3Futm_source=tldr%26utm_medium=newsletter%26utm_campaign=670427/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/913Thszr96tkvv46E1WgOayaqj0NgeR0Kx0JxSkx6RI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;🔨 Build Custom SOC Agents With MCP Servers (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Learn how to deploy multi-agent systems for your SOC using the Google SecOps MCP server, Agent Development Kit, and Agent2Agent protocol. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.brighttalk.com%2Fwebcast%2F18282%2F670427%3Futm_source=tldr%26utm_medium=newsletter%26utm_campaign=670427/2/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/wmclLbZtQ-68PIyG-wOZB5NZstAl5hNLcdilaWlIBIo=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Watch the video.&lt;/span&gt;&lt;/a&gt;
																											&lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F09%2F17%2Flondon-property-manager-breach-may-have-exposed-bank-details-and-lockbox-codes%2F5297232%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/BaEaGYAgRuIUDZcPhA7kCzYYLNSCKt23Y3YOrdJz1Ns=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;London property manager breach may have exposed bank details and lockbox codes (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    City Relay said attackers accessed its Metabase Cloud instance twice and extracted customer data.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FI3CsUc/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/TJE5ZhPfEWjApVY5MRP9iDgEEJc5E2ECLwh52cYSbBg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Malicious npm packages evade install-script defenses at runtime (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The 'indexed-btree' npm package, which impersonates 'sorted-btree' and pulls 2 million weekly downloads, hid its loader in the BTree.prototype.set() method to bypass npm v12's install-script approvals.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																						&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																							&lt;tbody&gt;
																								&lt;tr&gt;
																									&lt;td class="container" style="padding: 15px 15px;"&gt;
																										&lt;div class="text-block"&gt;
																											&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fvideocardz.com%2Fnewz%2Fintel-reportedly-ends-bug-bounty-rewards-for-security-researchers%3Futm_source=tldrinfosec/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/2fFkQWhdFEcst3UV5ol2y9BBzeiVemFZvNyvWdxGEqA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Intel suspends bug bounty program with rewards up to $100,000 (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
																											&lt;/a&gt;
																											&lt;br&gt;
																											&lt;br&gt;
																											&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Intel quietly suspended its Intigriti bug bounty program, which paid up to $100,000 per finding, replacing it with a no-reward vulnerability disclosure program and offering no public explanation for the change.
                                &lt;/span&gt;
																											&lt;/span&gt;
																										&lt;/div&gt;
																									&lt;/td&gt;
																								&lt;/tr&gt;
																							&lt;/tbody&gt;
																						&lt;/table&gt;

																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;


																		
																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Love TLDR? Tell your friends and get rewards!
																						&lt;/p&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
																						&lt;div class="text-block"&gt;
																							Share your referral link below with friends to get free TLDR swag!
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="padding: 10px;"&gt;
																						&lt;div class="text-block"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/H2Ks7eY09O-9Iosusi0jJeQ2RUcb0_KaOHEw3RZQIko=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																				&lt;tr&gt;&lt;/tr&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="padding:5px 10px;"&gt;
																						&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/-qHYIeaPvdYR_JL7JLpJDvMVCWKSQsmQxKKl5MazozY=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		


																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Want to advertise in TLDR? 📰
																						&lt;/p&gt;
																						&lt;div class="text-block" style="margin-top: 10px;"&gt;
																							If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/PL5Ge3Nbsgb9erBDVp-R8c6Vv31UKV3fxuU7Zeuc4sw=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
																						&lt;/div&gt;
																						&lt;br&gt;

																						&lt;!-- New "Want to work at TLDR?" section --&gt;

																						&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
																							Want to work at TLDR? 💼
																						&lt;/p&gt;
																						&lt;div class="text-block" style="margin-top: 10px;"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/R4mc-8DP3vOlnRp7_ImVuqyTZzQA58xs-MMpczQq-0U=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/rKZqr6QC3faEjAm3Llg_ICG04F_og5yzLsz_ek1lgkM=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/_yfPWIzmrqEYlHcNVY39yf2YTphtVKzfCNHk7uFVzRY=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
																						&lt;/div&gt;
																						&lt;br&gt;

																						&lt;div class="text-block"&gt;
																							If you have any comments or feedback, just respond to this email!
																							&lt;br&gt;
																							&lt;br&gt; Thanks for reading,
																							&lt;br&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/S29LvbzROe0yl8-m6hrxLoyQ6nzp8gzsCT9TjfvGDq8=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/0k9fN5s3KHyDmvS5hps1KP8A75INpgJemZT0q2Bc4Ks=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/MbZi_moaHk5qkgYrxK2dtDOiwX3leASuJGpp6oVbeYc=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
																							&lt;br&gt;
																							&lt;br&gt;
																						&lt;/div&gt;
																						&lt;br&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																		&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;
																			&lt;tbody&gt;
																				&lt;tr&gt;
																					&lt;td class="container" style="padding: 15px 15px;"&gt;
																						&lt;div class="text-block" id="testing-id"&gt;
																							&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/RsqlPQ0F_kYl1-QdrsCIjgdlnIOO7btZuiVJh8QHSkY=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=a486dff0-b669-11f1-b4e7-77ba7df85eec%26pt=campaign%26pv=5%26spa=1790082133%26t=1790082611%26s=00cbe9c9229d2f456e7dbd35914a0e36be8793e78d8bc420f01ad5b86375f5cd/1/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/Hul46ktdCji_-bctvJFPeb_VrPRJv3u3nRTUylA8i54=452"&gt;unsubscribe&lt;/a&gt;.
																							&lt;br&gt;

																						&lt;/div&gt;
																					&lt;/td&gt;
																				&lt;/tr&gt;
																			&lt;/tbody&gt;
																		&lt;/table&gt;

																	&lt;/td&gt;
																&lt;/tr&gt;
															&lt;/tbody&gt;
														&lt;/table&gt;
													&lt;/td&gt;
												&lt;/tr&gt;
											&lt;/tbody&gt;
										&lt;/table&gt;
									&lt;/td&gt;
								&lt;/tr&gt;
							&lt;/tbody&gt;
						&lt;/table&gt;
					&lt;/td&gt;
				&lt;/tr&gt;
			&lt;/tbody&gt;
		&lt;/table&gt;



	

&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a0c93cf8de-0a65e73f-5f66-49ed-957e-a269d5bc6755-000000/YT7MerwTBXxG5AmX6T_yKvCRZ3D1-nRFO9PXW6PIcGI=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
