The Daily Index — Monday, August 4, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL ALERT: AKIRA RANSOMWARE SURGE TARGETS SONICWALL FIREWALLS

Akira ransomware attacks targeting SonicWall SSL VPN connections have surged since July. Exploiting CVE-2024-40766 (CVSS 9.3) and unpatched SonicOS devices with disabled MFA, attackers rapidly escalate from VPN access to system encryption within hours, affecting hundreds of thousands of devices across multiple SonicWall generations. Organizations must immediately patch to the latest firmware, enable MFA on all VPN accounts, and restrict firewall management access to trusted IP ranges.

criticalpathsecurity.com · 3 min

TLDR InfoSec

ATTACKERS EXPLOIT LINK-WRAPPING SERVICES TO STEAL MICROSOFT 365 LOGINS

Cloudflare's Email Security team observed a new campaign in which threat actors abuse link-wrapping services from Proofpoint and Intermedia to phish users for Microsoft 365 credentials. Attackers abused Proofpoint link-wrapping in various ways, including multi-tiered redirect abuse with URL shorteners via compromised accounts. In the Intermedia campaign, threat actors sent a message impersonating a “Zix” secure message notification or a Teams notification that would redirect users to a fake login page to harvest Teams credentials.

bleepingcomputer.com · 2 min

TLDR InfoSec

EXPLOITING TRUST: HOW SIGNED KERNEL DRIVERS FUEL MODERN KERNEL LEVEL ATTACKS ON WINDOWS

An emerging pattern in kernel level attacks is to use a signed kernel loader to load a signed second stage kernel driver or reflectively load an unsigned kernel driver. These signed drivers are often signed via the Windows Hardware Compatibility Program (WHCP). The WHCP requires an extended validation (EV) certificate, which is designed to increase the security of the program. However, the EV certificate application process requires little human interaction, and there are dark web sellers of EV code-signing certificates.

links.tldrnewsletter.com · 11 min

TLDR InfoSec

KUBERNETES SECURITY FUNDAMENTALS: AUTHORIZATION

Kubernetes handles authorization by utilizing multiple authorization providers in the cluster requested in the order specified to the kube-server as flags on startup. Each provider can explicitly approve or deny the request or respond with “no opinion.” If all providers respond “no opinion,” the request is denied. Providers include AlwaysAllow and AlwaysDeny, which allow or deny every request; Node Authorizer, which restricts the access of the kubelet user; Attribute-Based Access Controls (ABAC), which enables cluster-admins to define authorization rules based on the request's characteristics statically; Role-Based Access Controls (RBAC), which is the most commonly used provider and maps permissions to roles; and Webhook, which is widely used in cloud provider clusters like AKS, GKE, and EKS.

securitylabs.datadoghq.com · 7 min

TLDR InfoSec

SILENT PUSH CEO ON CYBERCRIME TAKEDOWNS: 'IT'S AN ONGOING CAT-AND-MOUSE GAME'

In this interview, Silent Push CEO Ken Bagnall discusses tracking Funnull, a Philippines-based company providing infrastructure for financial scams that cost US victims $200 million. The firm maps criminal networks for law enforcement but faces challenges when groups adapt to surveillance. Bagnall compares state-tolerated cybercrime to historical privateering, requiring national-level responses.

theregister.com · 3 min

TLDR InfoSec

COMPOSE YOUR WAY WITH PROVIDER SERVICES

Docker Compose has announced the release of Provider services, which enables users to extend the capabilities of Docker Compose files by calling provider plugins that can interact with external services. This post includes an example of how to use the Telepresence traffic manager for a Kubernetes cluster.

docker.com · 3 min

TLDR InfoSec

ECHO (PRODUCT LAUNCH)

Echo offers CVE-free container base images in a similar space to Chainguard or recently Wiz. Customers simply need to replace their Dockerfile base image with Echo's secure version without any other changes.

echohq.com

TLDR InfoSec

ANTHROPIC SAYS OPENAI ENGINEERS USING CLAUDE CODE AHEAD OF GPT-5 LAUNCH

Anthropic revoked OpenAI's access to the Claude API after discovering ChatGPT engineers were using Claude Code tools ahead of GPT-5's expected launch next week. The incident highlights competitive tensions in AI development, with Anthropic's spokesperson noting that Claude Code has become the “go-to choice for coders everywhere,” including OpenAI's technical staff. Whether OpenAI used Claude Code to enhance GPT-5's coding capabilities remains unclear, but the timing suggests potential competitive intelligence gathering.

bleepingcomputer.com · 3 min

TLDR InfoSec

SEX TOY MAKER LOVENSE THREATENS LEGAL ACTION AFTER FIXING SECURITY FLAWS THAT EXPOSED USERS' DATA

Lovense fixed two security vulnerabilities that exposed user emails and enabled account takeovers. CEO Dan Liu is considering legal action over disclosure reports, claiming no data was compromised despite the security hole.

techcrunch.com · 2 min

TLDR InfoSec

WHEN PUBLIC PROMPTS TURN INTO LOCAL SHELLS: ‘CURXECUTE' – RCE IN CURSOR VIA MCP AUTO‑START

Aim Labs has discovered "CurXecute," a high-severity vulnerability (CVE-2025-54135, 8.6 rating) in Cursor IDE that enables remote code execution through prompt injection. While fixed in version 1.3, earlier versions remain vulnerable, and attackers can exploit developer privileges via poisoned MCP data for ransomware, theft, or AI manipulation.

aim.security · 4 min

TLDR InfoSec

SENATE CONFIRMS SEAN CAIRNCROSS TO BE NATIONAL CYBER DIRECTOR

In a 59-35 Senate vote, Sean Cairncross has been confirmed as the Trump administration's first Senate-approved cyber official.

nextgov.com · 2 min

TLDR InfoSec

NEW 'SHADE BIOS' TECHNIQUE BEATS EVERY KIND OF SECURITY

Shade BIOS is a UEFI malware technique that runs entirely in BIOS memory after OS startup, bypassing all security software, and operates as a parallel system.

links.tldrnewsletter.com · 4 min