The Daily Index — Friday, July 4, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CISCO FIXES MAXIMUM-SEVERITY FLAW IN ENTERPRISE UNIFIED COMMS PLATFORM (CVE-2025-20309)

Cisco discovered CVE-2025-20309, a backdoor vulnerability, in its Unified Communications Manager with unchangeable default root credentials. It affects only Engineering Special releases (15.0.1.13010-1 through 15.0.1.13017-1), allowing remote attackers root access. The vulnerability was found during internal testing with no known exploitation.

helpnetsecurity.com · 2 min

TLDR InfoSec

GRAFANA RELEASES CRITICAL SECURITY UPDATE FOR IMAGE RENDERER PLUGIN

Grafana Labs has issued security updates for its Image Renderer plugin and Synthetic Monitoring Agent to fix four high-severity Chromium vulnerabilities (CVE-2025-5959, CVE-2025-6554, CVE-2025-6191, and CVE-2025-6192). These flaws could allow remote code execution, memory access, and heap corruption via crafted HTML pages. Affected versions are those prior to 3.12.9 for Image Renderer and 0.38.3 for Monitoring Agent, both of which include a headless Chromium browser for dashboard rendering. Users should update immediately. Cloud and Azure instances have already been patched.

bleepingcomputer.com · 2 min

TLDR InfoSec

OUTSOURCED TRUST: HOW COINBASE'S $400M PROBLEM STARTED IN AN INDIAN CALL CENTER

Coinbase suffered a data breach that affected 69,461 users when outsourced call center employees illegally accessed customer information. The attackers demanded a $20 million ransom, but Coinbase offered a $20 million bounty instead. The breach enabled social engineering scams, resulting in losses exceeding $ 65.7 million.

reco.ai · 5 min

TLDR InfoSec

GUEST POST: HOW I SCANNED ALL OF GITHUB'S “OOPS COMMITS” FOR LEAKED SECRETS

A security researcher discovered that GitHub permanently stores "deleted" commits from force pushes as "zero-commit" PushEvents in the GitHub Archive, making supposedly removed secrets still accessible via commit hashes. By scanning all zero-commit force push events since 2020 using the GitHub Event API and GitHub Archive data, the researcher built automated tools to identify and analyze these hidden commits for leaked credentials, uncovering $ 25,000 worth of active secrets. Key security strategies include implementing pre-commit secret scanning, treating any committed secret as permanently compromised regardless of deletion attempts, immediately revoking exposed credentials, and protecting .env files, which were the most common source of leaked secrets.

trufflesecurity.com · 12 min

TLDR InfoSec

REVERSE ENGINEERING CURSOR'S LLM CLIENT

In this post, the authors used TensorZero, an open-source framework for optimizing LLM applications with downstream feedback signals, to observe the API calls and tokens sent between Cursor and the LLM providers. They first ran into errors connecting to TensorZero running locally because Cursor first sends a request to Cursor's servers for additional processing, so the authors needed to set up a reverse proxy to expose a public endpoint that would forward requests back to the local machine. They then had to solve for CORS issues. Eventually, they managed to wire Cursor up properly and included sample system prompts and interactions between a user session and what Cursor generates.

tensorzero.com · 6 min

TLDR InfoSec

RANSOMWARE GANG HUNTERS INTERNATIONAL SAYS IT'S SHUTTING DOWN

The Hunters International ransomware gang announced its shutdown on Thursday, offering free decryption keys to its victims. The group operated for two years, targeting organizations including a U.S. cancer center. Security experts suspect that this may be a rebranding effort, with the gang potentially transitioning to "World Leaks" to evade detection by law enforcement.

techcrunch.com · 3 min

TLDR InfoSec

UNCOVERING NYTHEON AI - A NEW PLATFORM OF UNCENSORED LLMS

Threat researchers at Cato CTRL have released a report on an uncensored LLM platform known as Nytheon AI. The operators behind Nytheon trained a suite of gen AI tools by employing jailbreaks on open-source models from Meta and Deepseek. The Nytheon AI suite includes models for code generation, document summarization and translation, OCR, and a control model.

catonetworks.com · 7 min

TLDR InfoSec

AWS CERTIFICATE MANAGER HAS ANNOUNCED EXPORTABLE TLS CERTIFICATES, AND I'M MOSTLY OKAY WITH IT

Recently, AWS Certificate Manager (ACM) added the ability to export certificates and private keys for use in EC2 or external applications. Currently, ACM does not implement ACME, so certificate renewals must be handled manually or via the AWS API. Organizations that want to ensure that private keys never leave ACM can disable exports at the AWS Organization level or on an account-by-account basis via SCPs.

lastweekinaws.com · 4 min

TLDR InfoSec

NEW FAKE MARKETPLACE FROM CHINA MIMICS TOP RETAIL BRANDS FOR FRAUD

A scam originating from China has led to the creation of thousands of fake shopping websites that mimic real stores, stealing payment information from global shoppers, especially during major sales events in Mexico.

hackread.com · 2 min

TLDR InfoSec

NORTH KOREAN HACKERS DROP NIMDOOR MACOS MALWARE VIA FAKE ZOOM UPDATES

North Korean hackers are deploying deceptive Zoom updates to distribute NimDoor malware on macOS and target cryptocurrency firms covertly to steal sensitive data.

hackread.com · 2 min

TLDR InfoSec

POLICE DISMANTLE INVESTMENT FRAUD RING STEALING €10 MILLION

Spanish police dismantled a fake investment scam that defrauded over €10 million from hundreds of victims through false advertisements, fake websites, and call centers claiming to be investment experts.

bleepingcomputer.com · 2 min