The Daily Index — Tuesday, August 12, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

BOUYGUES TELECOM HIT BY CYBERATTACK, 6.4 MILLION CUSTOMERS AFFECTED

Bouygues Telecom, a French provider, suffered a cyberattack that exposed the data of 6.4 million customers, including names, emails, and phone numbers, but not payment info. It notified affected customers and authorities during its investigation.

hackread.com · 2 min

TLDR InfoSec

CONNEX CREDIT UNION DATA BREACH IMPACTS 172,000 PEOPLE

Hackers breached Connex Credit Union systems June 2–3, likely stealing files with names, account numbers, debit card data, Social Security numbers, and government IDs. Connex reported 172,000 impacted, but there was no evidence of access to accounts or funds.

securityweek.com · 2 min

TLDR InfoSec

THE SECURITY PRINCIPLES GUIDING 1PASSWORD'S APPROACH TO AI

Seven core security principles for AI integration: encrypting secrets, using deterministic authorization over probabilistic LLM decisions, preventing raw credentials in LLM contexts, maintaining auditability, ensuring transparency, implementing least privilege, and balancing security with usability. AI agents must follow strict access controls, similar to humans, with credentials delivered securely (e.g., OAuth) rather than through LLM prompts, maintaining a zero-knowledge architecture. These principles show that traditional siloed privileged access management is inadequate for the AI era, which will require unified frameworks for both human and AI interactions.

blog.1password.com · 5 min

TLDR InfoSec

THREE DOTS TO ROOT: HOW I FOUND A PATH TRAVERSAL IN MICROSOFT'S AGENTIC WEB

Microsoft's NLWeb is a new framework designed to allow AI agents to interact with websites and APIs via natural language. This author describes how they discovered a path traversal vulnerability that could lead to the disclosure of arbitrary files such as `/etc/passwd` or `.env`. The vulnerability was caused by the use of the `os.path.normpath()` function, which does not prevent “climbing out” of the directory using `../`.

medium.com · 6 min

TLDR InfoSec

CONSTRUCTING A TRUSTWORTHY EVALUATION METHODOLOGY FOR CONTEXTUAL SECURITY ANALYSIS

DryRun Security uses an AI engine called Contextual Security Analysis (CSA) to analyze code changes probabilistically. Each PR goes through three steps: whole-PR synthesis to understand the goal, hunk-scoped reasoning to isolate individual code hunks and filter out unrelated changes, and on-demand context acquisition to retrieve supporting files and dependencies. DryRun also has a secondary audit model that randomly samples production findings every 24 hours to check instruction compliance, hallucination detection, and vulnerability accuracy.

dryrun.security · 7 min

TLDR InfoSec

EPSS PULSE (PRODUCT LAUNCH)

RunZero's EPSS Pulse is a free tool that tracks trends in Exploit Prediction Scoring System (EPSS) data to help security teams prioritize vulnerability remediation. It shows which vulnerabilities are gaining or losing exploitation likelihood over time, helping defenders focus on critical patches. Monitoring EPSS score changes enables organizations to make better vulnerability management decisions beyond static CVSS scores.

runzero.com

TLDR InfoSec

TONIC SECURITY (PRODUCT LAUNCH)

Tonic Security provides an AI agent–driven exposure management platform that ingests org data and threat intel to contextualize risk, prioritize remediation, reduce alert noise, and accelerate fixes. The company claims 50% faster MTTR and 90% fewer remediation actions needed.

tonicsecurity.com

TLDR InfoSec

UTILITIES, FACTORIES AT RISK FROM ENCRYPTION HOLES IN INDUSTRIAL PROTOCOL

OPC UA, a widely used industrial protocol, contains cryptographic design flaws that enable authentication bypass and message confusion attacks. Researcher Tom Tervoort has disclosed CVEs and PoCs that affect multiple vendors. He recommends applying patches, disabling OPC UA over HTTPS and Basic128Rsa15, and enforcing network restrictions like IP allowlists to limit exposure.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

APPSEC/PRODSEC'S REALITY GAP

Application and Product Security face a disparity in connecting theoretical security concepts to practical environments. A lack of context defines the problem space, teams trying to avoid slowing down development, security tools not addressing where teams are struggling or organizational scale, and tooling being designed for gates instead of guardrails. AI-based tools may help in providing more context and tailored experiences, but they will not alleviate the resource constraints that many teams face.

ventureinsecurity.net · 12 min

TLDR InfoSec

SECURITY FLAWS IN A CARMAKER'S WEB PORTAL LET ONE HACKER REMOTELY UNLOCK CARS FROM ANYWHERE

Security researcher Eaton Zveare found a vulnerability in a carmaker's web portal that let him create an admin account with full access. He could access customers' personal and financial data, track vehicles, and enroll customers in features to control some car functions remotely. During testing, Zveare remotely unlocked and took control of a friend's vehicle.

techcrunch.com · 3 min

TLDR InfoSec

GOOGLE CONFIRMS SALESFORCE CRM BREACH, FACES EXTORTION THREAT

Google disclosed a breach in its Salesforce CRM instance that exposed data of prospective Google Ads customers.

securityaffairs.com · 2 min

TLDR InfoSec

UK RETAIL GIANT M&S RESTORES CLICK & COLLECT MONTHS AFTER CYBER ATTACK, SOME SERVICES STILL DOWN

Marks & Spencer restored Click & Collect and most core online services months after the cyberattack in April, while some features remain down, such as online stock check, international orders, Sparks Pay, and occasion-cake ordering.

theregister.com · 2 min