Email: Bitget $387M hack 💸, Salesbleed Enables Slack Phishing 🤖, Supabase data leak 💧

Subject:
Bitget $387M hack 💸, Salesbleed Enables Slack Phishing 🤖, Supabase data leak 💧
Received:
9/28/2026, 1:11:03 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;



&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;On September 24, attackers stole $387.5 million from Bitget’s hot and warm wallets by feeding false transaction data into a compromised&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/5CwBIC1KXZOI3ig1qAsFMgDqwN9VwqTOCe9WStANJ-g=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/JfHc3nxqtRNdvPSHqkbHvNoR12wXGW269sqSwaBT8MM=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=b95b145e-bafc-11f1-81e7-cf91763cac50%26pt=campaign%26t=1790601062%26s=b0fded085a35ca9878d5baa9eef6266beb1d2a70d62eef16edae8324395a7b71/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/P79QErPo7hVXVsnlkuVT1RNo0vlrbzbMGs58ozRIUx8=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Faws.amazon.com%2Fmarketplace%2Fpp%2Fprodview-3xtziatyes54i%3Ftrk=df95e59e-c286-437e-b154-ce8c7c9527fc%26sc_channel=el/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/Wcni7g96nrnsnd_x9os74Md6YD2bYxIDJ5zxikCtWzY=452"&gt;&lt;img src="https://images.tldr.tech/awsmarketplace.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="AWS"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-28&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Faws.amazon.com%2Fmarketplace%2Fpp%2Fprodview-3xtziatyes54i%3Ftrk=df95e59e-c286-437e-b154-ce8c7c9527fc%26sc_channel=el/2/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/JZpfKB3l-PjtVSV4rwxtWpEHbUowcOz_V0dYnILDgQc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Firewalls that adapt as your workloads scale (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Scaling deployments means more east-west traffic between pods and services — harder to inspect, easier to exploit. Static firewall rules and manual certificate management can't keep up.&lt;p&gt;&lt;/p&gt;&lt;p&gt;Palo Alto Networks &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Faws.amazon.com%2Fmarketplace%2Fpp%2Fprodview-3xtziatyes54i%3Ftrk=df95e59e-c286-437e-b154-ce8c7c9527fc%26sc_channel=el/3/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/uH-fXDm9zcmPPAqiW_f-xhphU1AN3TPULADk1qcAVac=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;VM-Series Next Generation Firewall&lt;/span&gt;&lt;/a&gt; on AWS can help:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Automate TLS certificate lifecycle: AWS Certificate Manager Private CA handles rotation in Amazon EKS&lt;/li&gt;
&lt;li&gt;Adapt policies dynamically: Respond to AWS tags and metadata as your environment changes&lt;/li&gt;
&lt;li&gt;Block threats inline: AI/ML-powered inspection in real time without deployment latency&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Access &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpages.awscloud.com%2Fawsmp-palo-alto-networks-vm-series-ngfw-on-aws-marketplace.html%3Ftrk=01862119-680e-46fc-a13d-353643e5a158%26sc_channel=el/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/fbhLYr-YWmmM70gcXFirUByETxMRNYxiSS0VrP6ETmE=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;technical tutorials&lt;/span&gt;&lt;/a&gt; and start your &lt;a class="TypographyPresentation_31345133_root LinkThemeablePresentation LinkThemeablePresentation_450120641_root Surface_311631053_color--selected-text Surface_311631053_color-hover--selected-text-hover Surface_311631053_color-active--selected-text-hover HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock HighlightSol_1625403506_highlightSol HighlightSol_1625403506_core HighlightSol_1625403506_buildingBlock" href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Faws.amazon.com%2Fmarketplace%2Fpp%2Fprodview-3xtziatyes54i%3Ftrk=df95e59e-c286-437e-b154-ce8c7c9527fc%26sc_channel=el/4/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/Dpkc9sfRUycGCk7mznfShMl-1eDmCeyMsBPFoHidmNg=452" rel="noreferrer noopener" target="_blank"&gt;&lt;span&gt;free trial&lt;/span&gt;&lt;/a&gt; in AWS Marketplace.


&lt;/p&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ffinance.yahoo.com%2Fmarkets%2Fcrypto%2Farticles%2Fbitget-hack-timeline-own-system-164015015.html%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/oEXWuX8l5cmoFXx5qs44xqnhPd-wUrxMkI8kj5SzM1E=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Bitget Hack Timeline: How Its Own System Approved a $387 Million Theft (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    On September 24, attackers stole $387.5 million from Bitget's hot and warm wallets by feeding false transaction data into a compromised backend system, which then authorized the transfers. Bitget detected unauthorized activity at 18:31 UTC, paused withdrawals hours later, and ruled out private-key theft. Mandiant and SlowMist are investigating. CEO Gracy Chen has flagged possible North Korean involvement.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FJlEYnl/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/Sgl47n51W_if9oRGrMhvGPr3HEVSE4bZRdL1uq99UF8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Zenity identified three Salesforce Agentforce weaknesses. Attackers could inject commands via Web-to-lead forms and bypass URL filters. If connected to Slack, they could post phishing links in internal threads. The lack of confirmation and attribution controls made messages appear to come from employees or IT. Salesforce added confirmation prompts, spec-compliant URL parsing, and centralized URL inspection.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.cloudflare.com%2Fcontainers-cross-tenant-vulnerability%2F%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/G1EgSNJ9lCFqkfUK7N4LSJo-1lmYMZFW2CUDWLLUBIU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Cloudflare fixes Containers cross-tenant flaw exposing customer data (8 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Cloudflare remediated a cross-tenant flaw in Containers and Sandboxes that allowed a Workers Paid customer to read residual disk blocks left by other tenants on the same host. The flaw stemmed from dm-thin storage pools running with skip_block_zeroing, so a 4 KiB write into a reused 64 KiB block left the untouched 60 KiB readable via a raw read of /dev/vdc. Accomplish's Oren Yomtov, who reported it through HackerOne on September 4, recovered directory structures, database pages, and complete SQLite databases on 18 of 24 placements across 20 of 22 nodes, though an attacker could not target a specific victim or read an actively attached disk. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks, and cleared cached image snapshots by September 19. Its disk-I/O telemetry review found no exploitation beyond authorized validation, so no customer action is required.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.zerosalarium.com%2F2026%2F09%2Fedr-evasion-process-injection-without-WriteProcessMemory.html%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/ssC6MdRnKMaL9IgbJ3VwrKNJkJjfQPcouF0f3lyMkQU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;EDR Evasion: Process Injection Without WriteProcessMemory (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Zero Salarium details a remote process injection technique that skips the heavily monitored VirtualAllocEx and WriteProcessMemory pair, instead spawning an interactive console child (nslookup.exe or netsh.exe) and writing shellcode into its memory via WriteFile on the child's hStdInput pipe, then using VirtualProtectEx to add execute permissions and a thread hijack to point RIP at the payload. A distinctive marker locates the planted bytes, and the payload must avoid 0x0D, 0x0A, and 0x1A, which the console would treat as command input. Since the classic API pair is absent, defenders should watch for VirtualProtectEx against remote processes, read/write activity on named pipes, and the console's command-storage memory region.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.esa.int%2FApplications%2FSatellite_navigation%2FGalileo%2FGalileo_s_first_civil_authenticated_position_fix_under_spoofing_conditions%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/57a6dgrliKBv6b75SPxjejMOlD4smmq1jT4rD9JCTbM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Galileo's first civil authenticated position fix under spoofing conditions (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Galileo has demonstrated its first real-world civil position fix using the upcoming Signal Authentication Service, holding a stable lock across five satellites during live spoofing at the Jammertest event in Andøya, Norway on September 16. SAS encrypts the E6-C ranging signal's spreading codes and publishes the decryption key on a delayed, separate channel, letting a receiver correlate the recorded signal only after the fact to confirm each satellite's pseudorange. It pairs with the already-operational OSNMA, which authenticates the navigation message itself. Both services will be free and worldwide, extend to the High Accuracy Service, and let receivers detect and reject a broad range of spoofing attacks. However, EUSPA still must run SAS validation and accreditation before declaring the service operational, and the delayed-key design leaves jamming and meaconing as open concerns.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.scworld.com%2Ftech-explainer%2Foauth-token-abuse-how-the-attack-works-and-how-to-stop-it%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/AFP6Ftk_2flcet7b-lTJV7KnB_5QUoNzS6qki3HAL-Q=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;OAuth token abuse: how the attack works and how to stop it (7 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    OAuth token abuse gives attackers application-level access that survives password resets and MFA, since tokens belong to the app rather than the user, and can be obtained through consent phishing, device code phishing, credential additions to existing apps, or preconsented first-party applications. Because malicious apps live in the attacker's tenant, defenders should watch victim-tenant Entra ID events (Add service principal, Consent to application, Add delegated permission grant, and app role assignments) alongside anomalous post-consent activity, with behavioral app-to-purpose checks coming from Defender for Cloud Apps rather than native audit logs. The highest-value controls are preventive: restrict user consent to verified low-impact apps, require admin approval for high-risk scopes like Mail.Read and offline_access, and keep an approved application inventory, since eviction requires removing the grant and service principal rather than resetting credentials.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpages.awscloud.com%2Fawsmp-gim-i0v9-webinar-sec-grc-security-lab-grc-security-lab.html%3Ftrk=351a7c3a-1186-4574-a8eb-5f5b9837c220%26sc_channel=el%26sp=nFMGRaR8uj1TlEzCEnXN2VGr/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/k7L2n6yt0mD5grq0tR_9hd5KpirY_vrDaQ1x2kFRN1s=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Keep GRC aligned as AI scales (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    See how cloud AI and agentic systems introduce new risks across identity, data, and workflows. This on-demand demo explores IAM and access controls, sensitive-data protection, and modern detection strategies to help strengthen governance across the AI lifecycle. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpages.awscloud.com%2Fawsmp-gim-i0v9-webinar-sec-grc-security-lab-grc-security-lab.html%3Ftrk=351a7c3a-1186-4574-a8eb-5f5b9837c220%26sc_channel=el%26sp=nFMGRaR8uj1TlEzCEnXN2VGr/2/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/p3HlGt8FsN8EezGE_ju9KfuG2sPPc2GQTJRVj8lQ_c4=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Watch the security demo now.&lt;/span&gt;&lt;/a&gt;
&lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fkabiri-labs%2Frcekit%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/rBk2yBhXCr0fvwbO1S6IwOvlNoKeLuOw-kUlFWE2Bso=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;RCEKit (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    RCEKit is an RCE detection and confirmation toolkit for authorized penetration testing, red teaming, and security research. Point it at a target you are authorized to test — a URL or a captured HTTP request — and every finding returns with the tier it earned.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdetect.fyi%2Fintroducing-ade-skills-adversarial-detection-engineering-knowledge-base-397a8910c982%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/j7R9exTgEplRDwXFkYDRGXWyOoheWBibQi8-soc1cZQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Introducing ADE-Skills — Adversarial Detection Engineering Knowledge Base (5 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    ADE Skills, from Koifsec and Nikolas Bielski, is a knowledge base for adversarial detection engineering: the study of the gap between what a detection rule is intended to catch and what it literally matches. It organizes detection-logic bugs into a taxonomy of four categories (reformatting in actions, omitted equivalents like pwsh.exe vs powershell.exe, context development, and inverted or missing-field logic) across fifteen subcategories and thirty-seven worked technique files, each pairing a vulnerable rule with a hardened one. It also ships platform bug-pattern catalogs for Elastic, Sentinel, and Sigma, a false-negative checklist, a machine-mined catalog of ~593 candidate bypass findings across public rulesets, and Redamon, a purple-team scoping skill that maps in-scope techniques to a target's actual SIEM/EDR rules.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fstacklok%2Fmecatl%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/hsueLv4DufaXuX1DZr6kPAUaqR01bh36jqXg-BdyQyg=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Mecatl (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Mecatl is an open-source, cloud-native agent harness. Mecatl keeps the agent loop independent of the client and execution environment, so the same runtime can start locally, run remotely with durable external state and a recorded event history, and then scale across Kubernetes replicas without replacing the loop.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftechcrunch.com%2F2026%2F09%2F25%2Fsome-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web%2F%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/lyBsJZU8wwv8gN78Wi9UsI1_7eqZnrqGeuvyTk4Ipmk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Some Supabase customers are publicly exposing reams of people's data to the web (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    UpGuard found around 16,000 publicly accessible Supabase-hosted databases leaking names, addresses, phone numbers, and some passwords or tokens. Exposed data included private chats with sex workers on an Indian adult site, thousands of US valet license plates, immigration-service contacts, an African consulate's records in France, and a virtual SIM farm used to intercept OTP texts for scams. Most datasets were in the US, but the issue spans multiple regions. Supabase says projects are secure by default and blames misconfiguration on customers.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Farstechnica.com%2Fsecurity%2F2026%2F09%2Ftheres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before%2F%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/EeuT-Nw1ft6GXfNYusiFyZ2srLIcV-9L-gofWmPb30s=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;There's a new way to break RSA that's faster than anything we've seen before (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Researchers demonstrated a classical-computing attack that forges RSA signatures without factoring the private key. Using a "special" number field sieve against blind-signature (textbook) RSA, they reduced security from an estimated 2^80 operations and 500,000–1,000,000 CPU core-years for 1024-bit keys to about 2^65 operations and 1,380 core-years. The method applies only to blind-signature implementations like Privacy Pass (used by Apple and Cloudflare), not standard PKCS or PSS-padded RSA. Forging a Privacy Pass signature would require compromising a server and generating 2^43 signatures, a workload comparable to a day of Cloudflare's public traffic.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgambit.security%2Fblog-posts%2Fautonomous-ai-agents-online-retailers-25-a-company%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/oznusaSOW3lTQ0NDmUI96CJr1jiHq7jPPs4DDbFezbE=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;AI Agents Are Hacking Online Retailers for $25 a Company (14 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A financially motivated operator ran three open-source AI harnesses (Strix, Cairn, and Hermes) against hundreds of online retailers from July to mid-September, spending roughly $12,000–$18,000 on AI model calls. The campaign exfiltrated over 600,000 unexpired credit card records from two victims, injected skimmers into at least 27 sites, and achieved access to assets of a Fortune 500 hospitality firm, a major US airline, and other large retailers. In several breaches, the agent executed a "database wipe after extraction" routine that deleted payment data and, in one case, dropped 180 tables including backups.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fkiteworks-urges-customers-to-shut-down.html%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/53ylacQjsQjgFBvVKeOE1T1oxqU_KUXNJeWlSozNMME=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Kiteworks advised customers to shut down systems for nine hours after receiving threat intelligence about a possible attack.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FEhy6xe/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/T3eLQ4izv5rYVWeDV88VjLsMKmFsK5z-ROu8ArLSBGc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;OpenAI's AI agents accidentally uploaded user-provided images to third-party sites (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    OpenAI's research agents uploaded 53 training-eligible user images to third-party image hosts as unlisted links, most of which have since been removed as OpenAI's post-Hugging Face review of agent activity continues.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theverge.com%2Fai-artificial-intelligence%2F1001178%2Fopenai-agents-bruteforce-un-website%3Futm_source=tldrinfosec/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/ASXz_LZPeBOGBca6IllkHdh8RI4sOAorBHFeA3v3aVA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;OpenAI agents tried to 'bruteforce' a UN website (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    OpenAI agents scanned UNCTAD's statistics site over 16,000 times between April and June while trying to pull Productive Capacities Index data, escalating from bypassing their HTTP-tool limits to masking their behavior against an imagined filter and hijacking Google's XSS training game to reach the data.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/7EcfSDdB373l3rbh3afIGlpGKqBuVEAJJ6awoFjF-AU=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/P0PQV-lnKgmORMpMpoXJFCfppVChhPKMypa4U83ixP0=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/OKQHJJoUaXRRDxr4huxYNZToCEZdPEyovwrYdryCHdA=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/mnH3YgR6WcmgVQOmiZ8n0nF_oPw5sLTmm1opuZAXhac=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/GWYg5-V5w5FIqOZy62CpiPrURHIxGoiXGOHiTrPjLwM=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/s3jCekxpCHzT9uDGZ8lmGDYiuVtyb251ZXvKhAqbT80=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/413YxUrZENkEguBQrM1_x2T4MjkTrz8OPrQvHLdP7fU=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/jLW-YJOekqD3BC9hVKV8I-xyNLzMZZ7I1-SQcQpsNNw=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/gVeCMzSWzVwIRWr877pB7geePWzS4Vmm4uJOr1tdF6E=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/wPSBsWrEnowKM9XPLFpvsqvllrSNmrwBseo3LmWVxwE=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=b95b145e-bafc-11f1-81e7-cf91763cac50%26pt=campaign%26pv=5%26spa=1790600535%26t=1790601062%26s=781dc619b35ae51ee8ef38db457b6de2305018ddf1bc4cee9d89c55a8de87449/1/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/_NgTe2AR-imsV6gdWZQQdphVq-PzYDpfr14Z0Exjhuk=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a0e823eab4-794d7e81-ebf4-4120-9a23-7e26a8aa60f1-000000/uv85gWZxHg795E_Le-4pDj8FmewJmYEpvSEPkpYXHQA=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
