The Daily Index — Monday, July 28, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DATING SAFETY APP TEA BREACHED, EXPOSING 72,000 USER IMAGES

Tea, an app for anonymous dating reviews, suffered a data breach exposing 72,000 images, including 13,000 verification selfies and IDs. The breach affected users who signed up before February 2024. 4chan users reportedly shared the stolen data, coinciding with Tea's surge in viral popularity.

techcrunch.com · 1 min

TLDR InfoSec

POST SMTP PLUGIN FLAW EXPOSES 200K WORDPRESS SITES TO HIJACKING ATTACKS

A critical security vulnerability (CVE-2025-24000) in the Post SMTP WordPress plugin allows low-privileged users to access email logs and hijack administrator accounts by intercepting password reset emails. The flaw affects all versions up to 3.2.0 and stems from broken access controls that only checked if users were logged in without verifying their permission levels. Despite a fix being released in version 3.3.0 on June 11, over 200,000 WordPress sites remain vulnerable, as more than half of users haven't updated their plugin.

bleepingcomputer.com · 2 min

TLDR InfoSec

OSS-FUZZ INTEGRATIONS VIA AGENT-BASED BUILD GENERATION

OSS-Fuzz-Gen introduced an agent-based LLM approach that automatically generates build scripts and fuzzing harnesses for integrating projects into OSS-Fuzz, using iterative command execution and environment exploration to handle diverse C/C++ codebases. The system achieved 88 successful integrations from 225 tested repositories, demonstrating its ability to handle complex builds that require custom tools and dependencies. Key limitations include build scripts that avoid target source code or only support single-harness compilation, requiring post-processing validation improvements.

blog.oss-fuzz.com · 13 min

TLDR InfoSec

AI AND SECURE CODE GENERATION

The emergence of LLMs and coding agents fundamentally transforms application security, as AI now both writes and debugs code. As LLMs advance, humans will focus more on prioritizing vulnerabilities, providing additional context, and assessing exploitability. The vulnerability disclosure process will also become much quicker, with LLMs rapidly identifying vulnerabilities and offensive and defensive teams promptly collaborating to evaluate exploitability.

lawfaremedia.org · 12 min

TLDR InfoSec

HERODEVS (PRODUCT LAUNCH)

HeroDevs provides commercial licenses to over 30 Never-Ending Support (NES) products, which are patched versions of software that organizations already use, behave identically, and are compatible with modern browsers and key third-party libraries.

herodevs.com

TLDR InfoSec

AFTER BLACKSUIT IS TAKEN DOWN, NEW RANSOMWARE GROUP CHAOS EMERGES

International law enforcement's Operation CheckMate dismantled the BlackSuit ransomware group, but a new group called "Chaos" quickly emerged, likely comprising former BlackSuit members. Chaos is targeting major organizations primarily in the US, demanding ransoms of around $300,000.

arstechnica.com · 3 min

TLDR InfoSec

SCATTERED SPIDER IS RUNNING A VMWARE ESXI HACKING SPREE

Scattered Spider is targeting VMware ESXi hypervisors across retail, airline, transportation, and insurance sectors using social engineering to impersonate employees and trick IT help desks into resetting passwords for privileged accounts. Once they gain vCenter access, attackers enable SSH on ESXi hosts, perform "disk-swap" attacks to extract the NTDS.dit Active Directory database, wipe backups, and deploy ransomware to encrypt all VMs in the datastores. Google recommends hardening vSphere with execInstalledOnly, VM encryption, disabled SSH, phishing-resistant MFA, isolating Tier 0 assets, and centralizing logs in a SIEM to detect suspicious vCenter logins and configuration changes.

bleepingcomputer.com · 3 min

TLDR InfoSec

ANNOUNCING CHAINGUARD LIBRARIES FOR PYTHON: MALWARE-RESISTANT DEPENDENCIES BUILT SECURELY FROM SOURCE

Chainguard's Libraries for Python is a secure index that rebuilds Python packages and their dependency trees from source within a Supply-chain Levels for Software Artifacts (SLSA) Level 2-hardened setup to prevent supply chain threats. The platform specifically addresses Python wheels with native code and re-bundled OS libraries, such as OpenSSL, which create "software dark matter" that is hidden from SCA scanners. Early testing indicates that 98% of known malicious packages would be identified and blocked. This development follows notable incidents in 2023 and 2024 that involved attacks on PyTorch and Ultralytics YOLO where compromised builds and leaked API tokens facilitated malware distribution via PyPI.

chainguard.dev · 6 min

TLDR InfoSec

DOGE TURNS TO AI TO DECIDE WHICH FEDERAL REGULATIONS TO CUT

The Trump administration plans to utilize an AI tool called the "Doge AI Deregulation Decision Tool" to analyze 200,000 federal regulations and eliminate half of them by January, aiming to save trillions in compliance costs.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

RESEARCHERS EXPOSE MASSIVE ONLINE FAKE CURRENCY OPERATION IN INDIA

CloudSEK researchers used facial recognition and GPS data to expose a $2 million counterfeit currency operation in India, identifying over 750 social media accounts selling fake notes and pinpointing key perpetrators in Maharashtra.

hackread.com · 2 min