The Daily Index — Thursday, June 26, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MAINLINE HEALTH, SELECT MEDICAL EACH DISCLOSE DATA BREACHES IMPACTING 100,000 PEOPLE

Two major healthcare data breaches have been disclosed. Mainline Health Systems (Arkansas) suffered a ransomware attack by the Inc. Ransom group in April 2024, affecting over 101,000 individuals with stolen sensitive files. Select Medical Holdings (Pennsylvania) was impacted by a vendor breach at Nationwide Recovery Services that exposed nearly 120,000 people's data.

securityweek.com · 2 min

TLDR InfoSec

MILLIONS OF BROTHER PRINTERS HIT BY CRITICAL, UNPATCHABLE BUG

Rapid7 discovered eight vulnerabilities that affect 748 printer models from five vendors, with Brother accounting for 689 affected devices. The critical flaw CVE-2024-51978 (CVSS 9.8), which allows attackers to generate default admin passwords using device serial numbers, cannot be firmware-patched.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

FREQUENT REAUTH DOESN'T MAKE YOU MORE SECURE

Low session expiration times frustrate users and don't effectively improve security. Frequent reauthentication aims to prevent credential theft, but if attackers have physical access, a screen lock suffices, and if remote, expiration times are often too long to prevent breaches. Instead, systems should reauthenticate only before sensitive actions and use continuous verification like device checks and SCIM controls.

tailscale.com · 4 min

TLDR InfoSec

LEAKING SECRETS IN THE AGE OF AI

Researchers found that AI-related secrets dominate public code repository leaks, comprising 4 of the top 5 vulnerable secret types. The three main sources are Python notebook files, AI agent config files, and new AI vendor secret types that scanners overlook. Valid secrets from more than 30 companies, including Fortune 100 firms, were found, highlighting poor AI development security practices.

wiz.io · 8 min

TLDR InfoSec

VULNERABLE VS. EXPLOITABLE: WHY UNDERSTANDING THE DIFFERENCE MATTERS TO YOUR SECURITY POSTURE

Horizon3.ai suggests security teams should prioritize "exploitability" over "vulnerability," as many weaknesses can't be exploited in real-world scenarios. Their NodeZero platform conducted over 50,000 pentests in 2024, uncovering 765,000 critical exploitable paths and showing attackers can gain domain admin access in 60 seconds by chaining vulnerabilities and misconfigurations. They recommend continuous autonomous testing rather than annual assessments, with 82% of their customers now testing monthly compared to 26% of organizations testing more than once yearly.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

MICROSOFT MAKES WINDOWS 10 EXTENDED SECURITY UPDATES FREE, BUT THERE'S A CATCH

Microsoft has announced a new method for consumers to enroll their Windows 10 devices in the free Extended Security Updates (ESU) program. The method requires users to enable Windows Backup to sync settings and folders to the cloud. If a user has more than 5GB of data to sync, they must purchase additional space for Windows Backup to work and claim the free ESU enrollment. Users can also enroll in the program by paying $30 or redeeming 1K Microsoft Reward points for a year of updates.

theverge.com · 2 min

TLDR InfoSec

FRENCH POLICE REPORTEDLY ARREST SUSPECTED BREACHFORUMS ADMINISTRATORS

French authorities detained five suspected BreachForums operators, including known cybercriminals ShinyHunters, IntelBroker, Hollow, Noct, and Depressed, who allegedly ran the stolen data marketplace and targeted French companies. They tried to revive BreachForums after its earlier 2023 shutdown following the founder "pompompurin's" arrest.

therecord.media · 2 min

TLDR InfoSec

UK GOVT DEPT WEBSITE THAT CAMPAIGNS AGAINST ENCRYPTION HIJACKED TO ADVERTISE ... PAYDAY LOANS

The UK Home Office's 2022 anti-encryption "No Place to Hide" campaign website was hijacked to promote payday loans from Wage Day Advance. Tech expert Heather Burns discovered the unauthorized content insertion. This appears to be part of a growing trend where abandoned campaign websites on trusted domains are exploited for SEO spam content.

theregister.com · 3 min

TLDR InfoSec

AIR FRYERS AND SMART SPEAKERS MUST RESPECT YOUR PRIVACY, UK AUTHORITIES SAY

The UK's ICO has issued its first guidance on handling personal data after complaints about excessive data collection by smart devices, with users feeling powerless over how their data is shared and used.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

TREZOR'S SUPPORT PLATFORM ABUSED IN CRYPTO THEFT PHISHING ATTACKS

Trezor users are receiving phishing emails that mimic genuine support messages, with attackers exploiting Trezor's support system to send fake alerts and links to steal wallet seed phrases.

bleepingcomputer.com · 2 min

TLDR InfoSec

QUANTUM COMPUTERS JUST GOT AN UPGRADE – AND IT'S 10X MORE EFFICIENT

Researchers in Sweden developed a highly efficient, on-demand amplifier that conserves power and safeguards quantum bits, potentially boosting future quantum computers.

sciencedaily.com · 4 min