The Daily Index — Tuesday, June 10, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKER TARGETS OTHER HACKERS AND GAMERS WITH BACKDOORED GITHUB CODE

Sophos detected a campaign in which an attacker uses GitHub repositories with hidden backdoors to target other hackers and gamers. The repositories use various loaders to deploy various payloads, such as info-stealers and remote access trojans (RATs). Many of the fake repositories are designed to target other hackers, but some also use game cheats, mod tools, and fake exploits as lures.

bleepingcomputer.com · 2 min

TLDR InfoSec

MISCONFIGURED HMIS EXPOSE US WATER SYSTEM TO ANYONE WITH A BROWSER

While conducting a routine scan of industrial-control hosts, Censys researchers discovered an uncommon TLS certificate configuration that led to the discovery of a browser-based HMI platform. These internet-exposed platforms could be used to view and control water systems without authentication. Censys sent a bulk notification to the EPA, and the number of systems that were either read-only or fully controllable was reduced from 300 to 20.

securityweek.com · 2 min

TLDR InfoSec

EKS VS GKE - SECURITY

An in-depth comparison of security features in EKS and GKE. The post breaks down features by Identity and Access Management (IAM), controlling network traffic, configuration/posture management, vulnerability/supply-chain management, and runtime threat detection.

jason-umiker.medium.com · 17 min

TLDR InfoSec

FOLLOW THE SMOKE | CHINA-NEXUS THREAT ACTORS HAMMER AT THE DOORS OF TOP TIER TARGETS

SentinelOne observed and countered Chinese cyberespionage operations targeting the company in 2024-2025, including PurpleHaze reconnaissance and a ShadowPad intrusion via a hardware logistics partner, but SentinelOne wasn't compromised. The broader campaigns targeted 70+ organizations globally, including government, media, and cybersecurity vendors.

sentinelone.com · 16 min

TLDR InfoSec

OPEN-SOURCE TOOLKIT OF AN IVANTI CSA ATTACKER

In late 2024, Ivanti released advisories for vulnerabilities in its Cloud Services Appliance (CSA) product, which were discovered to be part of an exploit chain against the products. In this post, Synacktiv researchers break down three of the open-source tools they observed used by attackers in post-exploitation activities on these devices and provide YARA rules to detect them. The attacker planted Suo5 after the initial compromise as a webshell to be used on an internet-facing Exchange server. The attacker then established persistence using the iox tunnel and attempted lateral movement using atexec.py to gain remote code execution via Task Scheduler.

synacktiv.com · 9 min

TLDR InfoSec

GUARDZ (PRODUCT LAUNCH)

Guardz continuously monitors organizations' internal and external digital footprint to provide real-time protection. From a single dashboard, administrators can immediately take action when necessary.

guardz.com

TLDR InfoSec

GOOGLE FIXES BUG THAT COULD REVEAL USERS' PRIVATE PHONE NUMBERS

A security researcher discovered a Google bug that allowed attackers to reveal any account's private recovery phone number in under 20 minutes without owner notification. The exploit bypassed anti-bot protections through automated brute-force attacks. Google confirmed the fix after the researcher disclosed the vulnerability in April. It paid a $5,000 bounty and found no confirmed exploits occurred.

techcrunch.com · 3 min

TLDR InfoSec

LINUX FOUNDATION UNVEILS DECENTRALIZED WORDPRESS PLUGIN MANAGER

The Linux Foundation has launched the FAIR Package Manager, a new way to manage WordPress plugins and themes. It was created after a major conflict between WordPress companies Automattic and WP Engine. This tool gives developers more control by offering a decentralized and secure plugin system.

bleepingcomputer.com · 2 min

TLDR InfoSec

OPENAI BANS CHATGPT ACCOUNTS LINKED TO RUSSIAN, CHINESE CYBER OPS

OpenAI banned ChatGPT accounts associated with hackers in Russia and China who exploited the AI for cyberattacks, malware creation, and disinformation, while successfully mitigating the threats with partner assistance.

securityaffairs.com · 2 min

TLDR InfoSec

TRUMP CYBERSECURITY EXECUTIVE ORDER TARGETS DIGITAL IDENTITY, SANCTIONS POLICIES

President Trump issued an executive order altering previous cybersecurity regulations by eliminating support for digital IDs in public benefits, modifying the government's software, AI, and encryption approaches, and restricting cyber sanctions to foreign threats only.

securityweek.com · 2 min

TLDR InfoSec

MALICIOUS NPM PACKAGES POSING AS UTILITIES DELETE PROJECT DIRECTORIES

Two fake npm packages pretended to be useful tools but deleted all files in project folders instead.

bleepingcomputer.com · 2 min