Email: Linux vhost root bug 🐧, 8.6M karaoke fan leak 🎤, Eufy Wi-Fi UART hack 📻

Subject:
Linux vhost root bug 🐧, 8.6M karaoke fan leak 🎤, Eufy Wi-Fi UART hack 📻
Received:
10/13/2026, 1:10:14 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;



&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;Vghost is a Linux vhost bug (CVE-2026-74580, CVSS 8.8) that lets any user who can open /dev/vhost-net or /dev/vhost-vsock read and write&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/b9yIH2LLHdXoG93Ije8gJQajUM9RcVbXWNX1P3kln6M=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/YBsH6KZfFJRHWx7Wq0eLwdnv8bN8EPhUQLiXFBaR7kA=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=ab69c77a-c6f3-11f1-8337-d7d1a3b501e6%26pt=campaign%26t=1791897014%26s=429c50ed884292960ca63b846c2e486c9e2852affd1e9508ba4bea6f0a2c8797/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/wWYYNpCj6gRBwu8fVs72djXwGEOAe0HSyRVSRmFvrLg=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fevents%2Frethinking-your-2027-threat-intelligence-plan%2F%3Fsfcampaign_id=701Rc00000oGroOIAS%26utm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=WB_Hosted_Rething_2027_TI_Plan_20261014%26utm_content=header_22_million_reasons%26utm_term=2026-10-13_tldr_infosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/Nj267SfBBvUelv-XcUeLspeZHiROoLT8uMj4M_vnHCY=452"&gt;&lt;img src="https://images.tldr.tech/flashpoint.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Flashpoint"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-10-13&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fevents%2Frethinking-your-2027-threat-intelligence-plan%2F%3Fsfcampaign_id=701Rc00000oGroOIAS%26utm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=WB_Hosted_Rething_2027_TI_Plan_20261014%26utm_content=header_22_million_reasons%26utm_term=2026-10-13_tldr_infosec/2/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/lssASU-DLMPzxvvL2-t1Tj_hbvBW_0HTGtGEcg8SJnM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;22 Million Reasons to Rethink Your 2027 Threat Intelligence Plan (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Over six months, Flashpoint tracked &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fevents%2Frethinking-your-2027-threat-intelligence-plan%2F%3Fsfcampaign_id=701Rc00000oGroOIAS%26utm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=WB_Hosted_Rething_2027_TI_Plan_20261014%26utm_content=body_intro_22_million_illicit_posts%26utm_term=2026-10-13_tldr_infosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/AdkLFGsIiUDtarAb0ebhBqyLHSGgvWpBTF4VWpMXEmM=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;22 million illicit posts&lt;/span&gt;&lt;/a&gt; in which threat actors discussed, shared, or advertised AI toolkits built for criminal deployment.&nbsp;

&lt;p&gt;&lt;/p&gt;

&lt;p&gt;Before finalizing your 2027 plans, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fevents%2Frethinking-your-2027-threat-intelligence-plan%2F%3Fsfcampaign_id=701Rc00000oGroOIAS%26utm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=WB_Hosted_Rething_2027_TI_Plan_20261014%26utm_content=body_outro_flashpoint_experts_wednesday_october%26utm_term=2026-10-13_tldr_infosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/EZqlCZf-XRTndze2r5SdvHmjTAvX9RQmt5M8fBjv4Cc=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;join Flashpoint experts on Wednesday, October 14th&lt;/span&gt;&lt;/a&gt; as they take a data-driven dive into the state of threat intelligence today, where it's headed, and what you can do to protect your business from AI-enabled adversaries.&lt;/p&gt;

&lt;p&gt;Join to discover:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Proprietary data and insights on the growth of AI-enabled threats&lt;/li&gt;
&lt;li&gt;New benchmark data on AI spending and adoption&lt;/li&gt;
&lt;li&gt;What these findings signal for the future of threat intelligence&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fflashpoint.io%2Fevents%2Frethinking-your-2027-threat-intelligence-plan%2F%3Fsfcampaign_id=701Rc00000oGroOIAS%26utm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=WB_Hosted_Rething_2027_TI_Plan_20261014%26utm_content=cta_save_seat%26utm_term=2026-10-13_tldr_infosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/5cOx2FFAH_sPvGCVM90269KoDYhtjBixVKj8pQqdIak=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;&lt;strong&gt;Save your seat →&lt;/strong&gt;&lt;/span&gt;&lt;/a&gt;


&lt;/p&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FgUSCUA/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/P1VMEMIKTa-ydLNQ-h4OeKLtc6dzIWScNO1VkYuvb1U=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;iRhythm Data Breach Impacts at Least 360,000 People (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Hackers accessed third-party-hosted iRhythm applications from June 3 to June 8 and stole patient names, addresses, email addresses, birth dates, phone numbers, account details, device serial numbers, insurance numbers, and service dates. State filings cover at least 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. The attackers demanded ransom on June 9. iRhythm says there is no evidence of identity theft and no impact to medical devices or operations.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F10%2Fcyberxero-uses-claude-code-in-campaign.html%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/w9hqH4w8Aq2Rr16LzQ_t1qIEpuXkJ6UBmJRcrdJeIYA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records (5 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    CyberXero used Claude Code, 51 agents, PentAGI, and Cobalt Strike in two campaigns. One automated WordPress and e-commerce exploitation; one manually targeted Ukrainian energy and utilities. A leaked working directory exposed session logs, plaintext tokens, toolkits, reconnaissance data, and stolen records. One run scanned 4,708 targets, reached 429 admin panels, and deployed 32 web shells in 61 seconds. Operators reset sessions and claimed authorized testing to bypass refusals.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fmatrix.tencent.com%2Fen%2F2026%2F10%2F12%2Fvghost-cve-2026-74580%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/z1QmTvOxiyDZAkUH_lSMBHC8wdfAs3mAyWCrDwvY5cI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Vghost: Beyond the Privilege Boundary (8 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Vghost is a Linux vhost bug (CVE-2026-74580, CVSS 8.8) that lets any user who can open /dev/vhost-net or /dev/vhost-vsock read and write kernel memory and escalate to root. It affects kernels 4.11 through 7.2. Tencent Zhuque Lab confirmed the root exploit on five major distros and showed a malicious VM guest can use the same bug to hijack the host's QEMU process. Admins should patch to a kernel with fix de845981da67 and, until then, remove world access from both vhost device nodes, which RHEL, Amazon Linux, Azure Linux, and Oracle Linux expose by default.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadepts.of0x.cc%2Feufy-homestation2-firmware%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/lvlWkUS1oC7jNy0dn63H75uvJccctU607MNPZIZauGQ=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;A story of wifi secrets, UART lockdowns, and a damaged flash memory chip (15 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Researchers extracted firmware from an Eufy HomeBase 2 by desoldering its Winbond flash chip and reading it over SPI. They recovered most of firmware 3.4.2.2h, losing a 64 KB block during chip removal. Reverse engineering showed the OCEAN_ management Wi-Fi password uses HMAC-SHA256 over an I2C-read value, keyed by the device serial number, then URL-safe base64 encoding. The UART lockdown came from a login script checking an NVRAM debug flag. They patched the intact recovery image to force a root shell, reflashed it, then staged a temporary filesystem to run the main home_security binary for dynamic analysis.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fbreachcache.com%2Fcases%2Fhands-off-the-keyboard%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/jCrREgIBMkY-YnWbGY9SX5is2ZxxxPEoBVBwN7mmWRs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Hands Off the Keyboard: How AI Agents Run Real Intrusions (20 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Breachcache recovered 75 transcripts from servers used to run autonomous AI agent intrusions. The agents performed reconnaissance, selected exploits, gained command execution on 23 hosts, and, in one case, used SSRF to steal cloud instance credentials and launch a root instance. Other runs exploited SQL injection, rooted an Open WebUI service through CVE-2026-0766, and exfiltrated unmasked card data and crypto wallet keys. Operators used Cairn for coordination, rotated proxies and Tor for evasion, and audited source code to find payment-callback forgery and account-takeover flaws in AI gateway software.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwords.filippo.io%2Fright-answers%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/Ukt2VpwdDUOEk2CoLgsv3yabMmodWJNq9SbCLFaowLY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;(Post-Quantum) Cryptographic Right Answers (14 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The long-running "Cryptographic Right Answers" list has been rebuilt around a 2029 post-quantum deadline, and every asymmetric pick has changed: X25519+ML-KEM-768 for key exchange, HPKE with X-Wing or age PQ keys for encryption, and plain ML-DSA-44 over hybrid signatures. Former Go security lead Filippo Valsorda argues symmetric crypto stays safe because Grover's algorithm does not matter in practice. He drops OpenSSL in favor of rustls, Go's crypto/tls, BoringSSL, or AWS-LC after a run of 2026 CVEs in wolfSSL, Mbed TLS, and Botan. Several picks, including XAES-256-GCM, Cobblestone-128, and age, are his own designs, which he discloses alongside their independent adoption.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fsecuditor%2Fsecuditor-lite%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/noo9T7xz2UPydqkjzO4iGKtHyNCTU19rs0FvsMQtSQI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Secuditor Lite (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Secuditor Lite is a free, Python-based diagnostic security tool for Windows endpoints and networks. Featuring a user-friendly GUI, it provides a simple and transparent way to assess system security, helping users identify vulnerabilities, suspicious activity, and misconfigurations while improving device Operational Security (OPSEC).
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhadrian.io%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/bTG3CVN3Bq39CgiC7cmAiBYgYfSW9W2E_hVFnlXs9mY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Hadrian (Product Launch)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Hadrian is an offensive security platform that maps external attack surfaces, validates exploitable exposures, runs on-demand penetration testing, prioritizes risks, and verifies remediation.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FGitHubSecurityLab%2Fgh-secure%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/pgyedxR-Ad72uUb3W6Af5QDpzNW26AF0D5l4xvlLPY8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;gh-secure (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    gh-secure is a GitHub CLI extension that enables security features on public repos. It follows best practices from The GitHub Security Lab.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FIrNeXk/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/0YKYlZk7B2GqxiGPCqDdj8lT8OKehUBBZnE_oFcaAho=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Nippon Columbia Malware Incident Exposes 8.6M Karaoke Fan Records (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Daiichi Kosho, Japan's largest karaoke maker, disclosed that a breach at its contractor Nippon Columbia exposed the data of over 8.6M customers and almost 100K employees. The malware infection was discovered on an employee's computer and it was subsequently isolated. The exposed data may include full names, genders, dates of birth, email addresses, and phone numbers.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fworkos.com%2Fblog%2Foauth-auto-link-email-account-takeover%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/hsVTsWMFoere9IwmuT8ZkG2kzfQLiCwUsIlDyiFaWw0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Three OAuth account takeovers, one bug: Auto-linking by email (7 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers took over accounts in Pingvin Share X, Better Auth, and AshAuthentication by abusing auto-linking, where an OAuth sign-in is attached to whichever existing account shares its email address. Each library skipped a different check: Pingvin ignored email_verified, Better Auth never verified the local account's email, and AshAuthentication never compared the two emails, though the writeup comes from WorkOS, which sells a competing auth product. Developers should look up identities by issuer and subject ID first, require verified emails on both sides, and make users prove they own the existing account, including MFA, before any link happens.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fvinny.dev%2Fblog%2F2026-10-12-the-prompt-is-not-the-permission-securing-the-agentic-sdlc%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/50oYRJteTkBLuxoaqCDYdx4wlP0vgTjn_Z6Oud5xwWs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;The Prompt Is Not the Permission: Securing the Agentic SDLC (12 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Telling a coding agent what not to do does not stop it, because a malicious line in an issue, changelog, or config file can steer it into reading secrets or leaking private data while still producing a clean pull request. Real limits have to live outside the model, through isolated workspaces, task-scoped identities, short-lived credentials, and network policy. Test those limits directly, since an agent refusing a planted instruction proves nothing about whether the platform would have blocked the action.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.atera.com%2Fai%2Frobin%2F%3Futm_source=TLDR%26utm_medium=email%26utm_campaign=TLDR_IS/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/9p-oQi0aLtGTjv8PKN4HSI12fp35m_k0_ROLonOj-sI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;⚡️This AI agent resolves T1 &amp; complex T2 incidents from end to end (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Robin by Atera securely takes complex IT tickets from "hello" to "fixed". It verifies users, resolves issues, and verifies results so you can focus on higher-value security tasks. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.atera.com%2Fai%2Frobin%2F%3Futm_source=TLDR%26utm_medium=email%26utm_campaign=TLDR_IS/2/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/mC2fOT_b3kU7VRaz9ib0f0ugGR-CSugr9B1FElrVChw=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Meet Robin&lt;/span&gt;&lt;/a&gt;
&lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F4Ln9Gd/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/BGA-6ExZn40x9VnaKDfOagBBR4W4ZvWrs77mULvdzIE=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Norway fines Microsoft ad firm $9.6 million over Grindr data sharing (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Norway's data protection authority issued its largest fine ever, $9.6M, against Microsoft-owned Xandr for exposing Grindr users' sexual orientation data to thousands of advertisers through real-time ad auctions from 2018 to 2020 without valid consent.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Funchainedcrypto.com%2Fledger-says-all-confirmed-cases-trace-to-reseller-cryptobilis-gives-no-loss-total%2F%3Futm_source=tldrinfosec/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/aF6dhQfo1z0chX0VApGb1RSqJauKe4H7DGXMFD60abY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Ledger Says All Confirmed Cases Trace to Reseller CryptoBilis, Gives No Loss Total (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Every confirmed Ledger wallet drain traced back to Southeast Asian reseller CryptoBilis, though Ledger gave no loss total, while on-chain trackers estimated $93.2M to $103.4M stolen and Tether froze only about $10M before the attacker laundered funds through Tornado Cash and Zcash.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FpMT2cG/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/p4Wc_b72PXO9JEeyZIj2bYRNM8_HlH2Ad4vzfYEhvVs=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Anthropic says new safeguards sharply reduce AI distillation attacks (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Anthropic said new limits on access to Claude's reasoning cut data harvested by distillation attacks by 90% to 99%, after it banned tens of thousands of accounts and named Chinese startup Z.ai as one company that tried to copy Claude while building its GLM-5.3 model.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/ptuyZZsUAGFNv0Tkzqdl3lioFnu-4C2LWNwl5JEkNps=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/qYWSXK56fUZykFmxhJYqc6TfUcBLk_bS4KbdEOWpycw=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/Rdue1SxzJ5XkOS2_YJmniGVCDM6btqg27GtQHyW6JFk=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/oLV828BDrDYMr1W3XFVrrTZGps-cudqUZnnlpHWdEd0=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/8hMJxZokoKwtiQVPKrxK4qtCqWhIn9h4G3xeLgNNnSM=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/sLZKKWrUjJffxRQog-TyFLMW1qHNirB3jCQjO_dc_aA=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/fq_0THoj81kHzERtEjQa8ss_WUIK2UZIpK8D_FtPuo4=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/BudI88jsuAK5EbhC3m0oO8GO7nAYW7V-F4n4Fs976EQ=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/KAbx5sZQBzYBg5ft0Dk5nR9yG2i-9jJzV7JDw4hB-s0=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/liH24tm0jkKS0vkBgVp0FFGjFbHF1mCCgf5fCRuBSXs=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=ab69c77a-c6f3-11f1-8337-d7d1a3b501e6%26pt=campaign%26pv=5%26spa=1791896550%26t=1791897014%26s=de863109a3ac9f2704283a4f0379ab1e722b824e8aee6b271084aaca3bfd9262/1/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/ob89ho8s8ka9Xw2XZcpRmKN_uFfBKvMJ_JIITfntP80=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a1356292c8-1a8f906b-f3e6-41e7-8cec-0992504262c8-000000/0rvJGrNaU5uFbLzkB_5gC9h_3h9tSIb2Nrn3uJnbYko=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
