Email: Meta Muse AI 0-day 🤖, ShinyHunters hacks Clop 🏴‍☠️, EU's $463M Google Fine 💸

Subject:
Meta Muse AI 0-day 🤖, ShinyHunters hacks Clop 🏴‍☠️, EU's $463M Google Fine 💸
Received:
9/23/2026, 1:09:58 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;






&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;A zero-day allows any local macOS app or terminal command to redirect Muse transcription to an attacker-controlled server. The server receives&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/PNG-pGzchSBKSNZf0gW1ntS-2FyTELu3KIz8soDKub0=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/Z5IJX1qlIs6df7rgRVLpfF46GyJ6ivi4HztaVL2yvgc=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=7c36d6e8-b72e-11f1-b6da-e925b12eda27%26pt=campaign%26t=1790168998%26s=e537138474c0eb934435de4d054d24347cfffe3b1be13474b2591fe185bd6565/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/EDo_v7HkD7Ur4pdfuL-ObNWHYHOK0sE5LDEf2JL6rKg=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fblog%2Fflashpoint-named-a-customer-favorite-in-the-forrester-wave%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=Resource_RP_Forrester_Wave_2026%26utm_content=header_flashpoint_just_named%26utm_term=2026-09-23_tldr_infosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/uboDu-Rn4Vj-PWH4bKVt7OjAVpj71LGkgLmVwgCxV3w=452"&gt;&lt;img src="https://images.tldr.tech/flashpoint.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Flashpoint"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-23&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fblog%2Fflashpoint-named-a-customer-favorite-in-the-forrester-wave%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=Resource_RP_Forrester_Wave_2026%26utm_content=header_flashpoint_just_named%26utm_term=2026-09-23_tldr_infosec/2/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/HThWs-0StXP5VRbijHNfQkNgLw1bJATsDr4Gp6HBauw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Flashpoint just named a Customer Favorite in the 2026 Forrester Wave™ for Threat Intelligence. (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Based on outstanding customer feedback in the all new Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. Flashpoint also received the highest scores possible for the Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency criteria.&nbsp;&lt;p&gt;&lt;/p&gt;&lt;p&gt;Access the report to see how top vendors scored across 23 criteria and learn why Flashpoint is ideal for customers seeking primary source access intelligence.&lt;/p&gt;&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fblog%2Fflashpoint-named-a-customer-favorite-in-the-forrester-wave%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=Resource_RP_Forrester_Wave_2026%26utm_content=cta_access_full_report%26utm_term=2026-09-23_tldr_infosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/u9BDolZ7DvvTZPsC-wl2g9QzQkADXqIHybH_q7teTPs=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;Access the full report&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;


&lt;/p&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcyberpress.org%2Ftanstack-npm-supply-chain-attack-exposes-170-private-crowdsec-github-repositories%2F%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/u7cLlkDtrES6pbbUYmL8l-Xf8ooM3DqHUn9h9w3_6uc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;TanStack NPM Supply Chain Attack Exposes 170 Private CrowdSec GitHub Repositories (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers used a former CrowdSec employee's GitHub OAuth token following the May TanStack compromise. On May 22, they cloned about 170 private repositories within nine minutes. The leaked archive contained private code and contact data for 83 users. Investigators found no code changes, CI/CD access, or AWS access. The attackers tested one scoped SNS credential, but IAM permissions blocked it.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Farstechnica.com%2Fsecurity%2F2026%2F09%2Fmuse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day%2F%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/4Jhxu3quIGC8laXxXZfi1Tmcimf1Ag9esDmD5gqq_rI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A zero-day allows any local macOS app or terminal command to redirect Muse transcription to an attacker-controlled server. The server receives the account token, enabling control over Muse and its connected email, WhatsApp, calendar, social accounts, microphone, camera, and files. Researcher Patrick Wardle demonstrated prompts that write files or take photos. Amazon also blocked Muse shopping requests as unauthorized.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2Fqm2wHm/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/fSvap_cEufnNYmZrXwHrrBGl2iSSdYH_2VfqqgXcok8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;ShinyHunters Hacks Clop Leak Site, Threatens to Extort Ransomware Gang (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The ShinyHunters ransomware gang hacked the Clop ransomware gang's data leak site on Tor, defaced it, and claimed to have stolen server data and private keys for its onion service. The ShinyHunters claim to have exploited an unauthenticated file upload vulnerability in Grav CMS to breach the site. This appears to be the latest escalation in an ongoing feud between the two ransomware gangs.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Funsecure.sh%2Fblog%2Fagentic-soc-scenario%2F%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/2it4d6quWuxbtEI5BI16gUtjSxEZ174om7lgt4S-CvM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;A Scenario to Evaluate Your Agentic SOC (20 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A SOC investigation loop requires assembling a full attack chain from various different signals that may look benign or unrelated, which traditional, deterministic playbooks may miss. The authors built a set of scenarios to evaluate agentic SOC's investigative ability and built their own harness (called Tengu). Their scenario involves a GitHub workflow vulnerability that leads to full Kubernetes cluster compromise, which then is escalated to full AWS account compromise. Of the models tested on a naive prompt, only Opus 5 managed to identify the alert as a true positive without the Tengu harness
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.gendigital.com%2Fblog%2Finsights%2Fresearch%2Finfostealers-your-ai-agent%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/bEizfiVA6PJEjxJiu7gk1wx22LENtWjPa8v1AA5uhZY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Infostealers Have Found a New Target: Your AI Agent (10 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Researchers from Gen have observed multiple new infostealers that harvest credentials, context, and local data from AI agents. Users and security teams should inventory what gets cached locally, keep secrets out of prompts and history, limit what connectors can do, and continue securing endpoints. Agent providers should also share the burden by providing more secure default behaviors.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.talosintelligence.com%2Fthe-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant%2F%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/MiXlJNe8o9cNUkcJjGQqBAtlely0KyLTeWoX_Rq5XIc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;The Closed Quorum: Inside the first reported autonomous AI C2 implant (9 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    CLOSEDQUORUM, a Go-based Windows implant, uses DeepSeek, Qwen, Mistral, and Gemini as its C2. Every 5 to 15 minutes, the models vote through a constrained JSON schema on whether to steal LSASS, browser, and crypto wallet credentials, inject shellcode, or persist via Run keys, scheduled tasks, and WMI. Talos hasn't seen it in the wild, and the public build is an inert template, but it points to a credentials-as-a-service model where each operator gets a custom build and never needs to be online. Its dependence on commercial APIs brings refusals, rate limits, and a deterministic DeepSeek tiebreak, so defenders should correlate multi-provider LLM traffic from unexpected executables with LSASS access, suspended-process injection, WMI persistence, and Discord webhook exfil instead of blocking domains.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt; &lt;div class="text-block"&gt;&lt;span&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2Faudiences%2Fcybersecurity-awareness-month%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=secondary09232026%26sp=PeufVai8jD4wJpgVxODYqWYS/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/M8L_vpt9cr0J25tmB2X4MsGK6x0-JsUxIIplQEZCEas=452"&gt;&lt;span&gt;&lt;strong&gt;Add TLDR InfoSec to your Cybersecurity Awareness Month plan (Sponsor)&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;span style="font-family: ;"&gt;Your prospects will see cybersecurity ad after cybersecurity ad on social this October. In TLDR InfoSec, your ad reaches 410K cybersecurity professionals and is one of just three ads per issue. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2Faudiences%2Fcybersecurity-awareness-month%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=secondary09232026%26sp=PeufVai8jD4wJpgVxODYqWYS/2/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/b5_ouQOnKSX7cgVGqGJz9KsBU6hL5l0YtgCKc5UQ6jc=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Learn more about our special Cybersecurity Awareness Month ad packages.&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/div&gt; &lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhelmguard.ai%2F%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/3LymO0acLno27gxyzp78frtlxaAGnji_V7kU9dLPdt0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;HelmGuard (Product Launch)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    HelmGuard provides governance, risk, compliance, and security software. It gathers evidence from source systems, documents, and unstructured data, then automates risk assessments, assurance tasks, and control-gap reviews.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fdirkjanm%2FaskWAM%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/HD6E4v_bRL2oVV4aazvY6D7Xmd2tEr9vwXjHqiirm8g=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;askWAM (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    askWAM is a tool to request Microsoft Entra access tokens silently through Windows Web Account Manager (WAM).
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2F0x574R%2FDarkcloak%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/byC1gFKwhR22PSiCxDF-tpOjNSuyi9qVrVnv7bdlr8E=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;DARKCLOAK (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    DARKCLOAK chains the manipulation of all userspace-visible identity sources into an 11-phase sequential pipeline that progressively transforms a process until it becomes indistinguishable from the impersonated one to userspace monitoring tools.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F09%2F21%2Fanthropic-linked-cves-pile-up-attackers-mostly-shrug%2F5298018%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/SoB5rztWdVEWDvFMBPj_fNppuCVJprcd7rvZf06ALBw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Anthropic-linked CVEs pile up, attackers mostly shrug (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    VulnCheck's Patrick Garrity tracked 225 CVEs tied to Anthropic's Project Glasswing, which gives partners access to the Claude Mythos Preview model for bug-hunting. Only one, a critical SQL injection in Ghost (CVE-2026-26980), has been exploited in the wild. Garrity says that historically 1-2% of vulnerabilities are weaponized, so this rate isn't unusual. AI models are uncovering more bugs, driving recent record patch counts from Microsoft, Apple, and Palo Alto Networks, but fixing bugs remains weak: 1Password found that Opus 4.8 and ChatGPT-5.5 fully resolved vulnerabilities in only 26% of 6,080 patches tested, and Veracode measured a 56% average security pass rate across 100+ models.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fabcnews.com%2FTechnology%2FwireStory%2Fgoogle-hit-463-million-fine-eu-location-data-136616044%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/ohrvS2eT5s_tMYDgJ1Kx_FFO5ifrh-6FVqG_UoyU5bU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Google hit with $463 million fine for EU location data rule breach (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Ireland's Data Protection Commission fined Google 403 million euros for GDPR breaches involving location data. The probe covered Web &amp; App Activity, Location History, and Android's Location Accuracy feature from 2018 through February 2020. Regulators found the processing unlawful, unfair, or opaque, even though Google said it changed its policies and released new location-management tools in 2019.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FXmS6zh/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/CzzefP9bb-CtQxUwTnxwfOtNgpGA0UqvUnRSQfikGbQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;ShinyHunters Claims FBI Hack, Data Theft in PeopleSoft Zero-Day Breach (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The ShinyHunters claim to have breached the FBI's job site and networks using a zero-day in Oracle PeopleSoft. The ransomware gang claims to have stolen 2-3TB of data, including PII and PHI of current and former FBI employees and job seekers, as well as other internal records. The hackers said they carried out the attack in retaliation for an FBI FLASH report on ShinyHunters.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FuMXRN4/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/cMnC--YKaYZ1Jr6GCF8UL5OYbrtfEm31BZr8jXENGPg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Brevo Supply Chain Attack Injects Malware Into 100,000 Websites (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers exploited Brevo SAML SSO handling, accessed 138 accounts, and later used a stolen Cloudflare API key.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fcritical-check-point-management-server.html%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/YzFZYOOZiULEviaoIFANbUevLHm-9iWQRjXH1DtRnnQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Check Point patched CVE-2026-91843, a CVSS 9.8 login stack overflow.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ffreenode.net%2Farticle%2Fglibc-ld-so-toctou-lets-local-users-hijack-origin-on-setuid-binaries%3Futm_source=tldrinfosec/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/-gKGY6_4g4MJ9PSarJRkUG2WCOBFwKUJE8PRNIyPgpc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;glibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A race in glibc's ld.so (CVE-2026-86805, versions 2.14 through 2.44) lets local users hardlink a setuid binary whose $ORIGIN RPATH uses ".." traversal and swap in a symlink to load attacker code with elevated privileges.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/zEBrahXclE4II-9_-XE5LaTwXVxuR2kBgz3CSIAz0H8=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/gXXdEoQszskFApA4LncJPnGEFMG0JT8aWOz58QnrpSI=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/iesaQNC5YiGmeAInTBwmTo2NemSDDfgemUVAE2DlzRo=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/cbxUboEJ1y1hdE07cCbxIdjoSfzyk41WYcs0de8EkUo=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/wWuxlP9uoAR8Gmq1aY-UO6qB6tutGhYG_JGg-vmGUkA=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/XYN539htxEg5fcBEpNR4GakmtbdvR8FzZWqPtZOyrgc=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/XYVXTjhWKUxZRvPghpE6dUX8ML4ukF9RjvaVE2CSDaw=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/0N_OBPn-j7CH__aWjWhI-g3W2i4N4wx3f3j99NFYkv4=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/fu7gJWrA6LpDx88evIElMX-rhYwd_ztkiEgaHOos5PY=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/XZfupJy0X9ZvbqkjH7ReKKme2y3a8m59FmBMQoD_qA0=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=7c36d6e8-b72e-11f1-b6da-e925b12eda27%26pt=campaign%26pv=5%26spa=1790168487%26t=1790168998%26s=1feaf64d89872b3a7c0b2773e06d2716c07b3b732dfb37d5868ea00ee69a1c70/1/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/HfPeS6STnx2Tl0dQMSx6lvnUeE_eotj4dmRwkUkbU8s=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a0ce632120-df5cf7f2-2fb6-45ec-9521-1e69255607eb-000000/7u9pDyH1dnOmBPdx_fpfTdRHaRNaM1JsDmDdDnz6-1o=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
