The Daily Index — Tuesday, May 20, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

480,000 CATHOLIC HEALTH PATIENTS IMPACTED BY SERVICEAIDE DATA LEAK

Serviceaide disclosed to HHS that 483,000 Catholic Health patients' personal and medical data were potentially exposed due to an unsecured Elasticsearch database between September and November 2024. While no confirmed data theft occurred, affected individuals will receive free credit monitoring and identity protection services.

securityweek.com · 2 min

TLDR InfoSec

210K AMERICAN CLINICS‘ PATIENTS HAD THEIR FINANCIAL DATA LEAKED

Georgia's Harbin Clinic reported over 210,000 patients affected by a July 2024 cyberattack on its debt collection vendor, Nationwide Recovery Services. The breach exposed names, addresses, SSNs, birth dates, and financial information.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

EXTRACTING MEMORY OBJECTS WITH MEMPROCFS/VOLATITILITY3/BSTRINGS: A PRACTICAL GUIDE

RAM can be a goldmine of real-time data for forensics experts. MemProcFS is a tool that organizes memory data in a virtual file structure that can be browsed and extracted. Volatility is another memory forensics tool that provides advanced capabilities such as advanced memory carving techniques, more detailed malware analysis, and reconstructing deleted or hidden processes. Tools like grep, strings, and bstrings can be used to identify artifacts in memory dumps.

medium.com · 8 min

TLDR InfoSec

BUILDING OWN MCP - AUGMENTED LLM FOR THREAT HUNTING

When developing MCP servers, it is essential to understand the use case and identify the potential risks before delving into the design. This post provides a checklist of security considerations for designing and utilizing an MCP server and client. It walks through a lab environment testing an augmented LLM for threat detection, which uses VirusTotal and Alien Vault for threat intel, the ELK stack, and a series of Windows hosts, and tests the MCP Server in three threat scenarios.

tierzerosecurity.co.nz · 8 min

TLDR InfoSec

CLOUD INCIDENT READINESS: CRITICAL INFRASTRUCTURE FOR CLOUD INCIDENT RESPONSE

On Azure, security teams can utilize log analytics and storage accounts to analyze logs and subscription groups and Entra ID for containment and conditional access. In AWS, CloudTrail and Athena can be used for log analysis, and separate accounts with cross-org access can be used for containment and conditional access. In GCP, logs explorer can be used for log analysis.

invictus-ir.com · 12 min

TLDR InfoSec

HAVE I BEEN PWNED 2.0

The new Have I Been Pwned 2.0 website has launched with many improvements and new features. It includes a better search function, a dedicated breach information page, and a user-friendly dashboard. The site focuses on maintaining its helpful services while enhancing overall professionalism.

troyhunt.com · 11 min

TLDR InfoSec

NHS ENGLAND LAUNCHES CYBER CHARTER TO SHORE UP VENDOR SECURITY PRACTICES

NHS England launched a cybersecurity charter asking suppliers to implement eight security commitments to combat increasing ransomware threats. Requirements include patch management, multi-factor authentication, 24/7 monitoring, immutable backups, and following the software code of practice. The NHS will support compliance through tools and contractual frameworks.

itpro.com · 3 min

TLDR InfoSec

OPENAI PLEDGES TO PUBLISH AI SAFETY TEST RESULTS MORE OFTEN

OpenAI published a new Safety Evaluations Hub, a web page showing how the company's models score on various tests for harmful content generation, jailbreaks, and hallucinations. OpenAI has stated that it may add additional evaluations in the future.

techcrunch.com · 2 min

TLDR InfoSec

PWN2OWN BERLIN 2025: DAY THREE RESULTS

White hat hackers have been awarded $1,078,750 for 28 previously unknown vulnerabilities across operating systems, AI products, container software, browsers, virtualization software, and servers.

zerodayinitiative.com · 3 min

TLDR InfoSec

FAKE KEEPASS PASSWORD MANAGER LEADS TO ESXI RANSOMWARE ATTACK

Hackers created a fake version of the KeePass password manager to steal data and install ransomware and spread it using ads and fake websites resembling real software pages.

bleepingcomputer.com · 3 min

TLDR InfoSec

MOZILLA FIXED ZERO-DAYS RECENTLY DEMONSTRATED AT PWN2OWN BERLIN 2025

Mozilla has addressed two critical vulnerabilities in Firefox discovered during the Pwn2Own Berlin 2025 contest, which could allow attackers to access data or execute malicious code, urging users to update immediately for safety.

securityaffairs.com · 2 min