The Daily Index — Monday, August 18, 2025

GENERAL

TLDR InfoSec

See Network Control in action

Summary unavailable

threatlocker.com

TLDR InfoSec

PLEX WARNS USERS TO PATCH SECURITY VULNERABILITY IMMEDIATELY

Plex has reached out to some of its users and urged them to update their Plex Media Server installation due to a recently patched security vulnerability. Plex has not assigned a CVE to the vulnerability or released details yet, but has stated that it was discovered via the Plex bug bounty program.

bleepingcomputer.com · 2 min

TLDR InfoSec

UK TELECOM FIRM COLT SUFFERS MASSIVE RANSOMWARE ATTACK

The Warlock ransomware gang targeted the UK telecommunications firm Colt, causing disruptions to its online and voice services. In response, Colt took its systems offline, resulting in service interruptions, and is currently in the process of restoring operations. The attackers have claimed to have stolen sensitive data, potentially exploiting a flaw in Microsoft SharePoint.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

PROTECTING AGAINST TYPOSQUATTING WITH WEBSITE TYPO PROTECTION IN MICROSOFT EDGE

Website typo protection is an automatically enabled, typosquatting protection in Microsoft Edge. Upon typing a misspelling of a common domain in Edge, the user will get a notification of the potential typo, and the address bar will include a “Not Secure” badge (similar to when visiting a website without HTTPS). This post provides details for configuring protection if it isn't enabled and includes screenshots of the notifications.

petervanderwoude.nl · 4 min

TLDR InfoSec

POST-QUANTUM TLS IN PYTHON

In preparation for the creation of a Cryptographically Relevant Quantum Computer (CRQC), NIST selected three post-quantum (PQ) cryptographic standards. This post details how to test hybrid TLS, where classical keys are used in combination with PQ ML-KEM keys, in Python on AWS. boto3, the Python SDK for AWS, relies upon the Python `ssl` module, which in turn relies on OpenSSL, which added support for hybrid TLS in version 3.5.

aws.amazon.com · 5 min

TLDR InfoSec

KAFKA ENCRYPTION FOR CARDHOLDER DATA: SOLVING PCI CHALLENGES WITH KROXYLICIOUS

This article explains how to achieve end-to-end encryption of credit card data in Kafka without changing any application code, using the Kroxylicious proxy. This solution simplifies PCI compliance and data protection by encrypting messages transparently, minimizing disruption to existing systems and workflows.

devsecopsai.today · 10 min

TLDR InfoSec

APPROV (PRODUCT LAUNCH)

Approv provides runtime protections to secure devices, apps, APIs, and the channels used to communicate with the cloud, as well as real-time threat analytics to deliver visibility into mobile application security.

approov.io

TLDR InfoSec

RUSSIAN GROUP ENCRYPTHUB EXPLOITS MSC EVILTWIN VULNERABILITY TO DEPLOY FICKLE STEALER MALWARE

Russian threat actor EncryptHub is exploiting patched Windows vulnerability CVE-2025-26633 via social engineering and malicious MSC files to deploy Fickle Stealer malware and backdoors. The group uses fake IT support requests, a compromised Brave Support platform, and fake videoconferencing to gain control. Attacks feature encrypted C2, persistence, and evasion techniques like fake browser traffic.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

GOVERNMENT PAPERS FOUND IN AN ALASKAN HOTEL REVEAL NEW DETAILS OF TRUMP-PUTIN SUMMIT

State Department documents with sensitive details about the August 15 Trump-Putin summit were left in an Alaskan hotel's printer. The eight pages revealed meeting locations, times, and phone numbers of U.S. government employees involved in the summit at Joint Base Elmendorf-Richardson. Guests found the papers, photographed them, and reported the breach.

databreaches.net · 1 min

TLDR InfoSec

HOW YOUR SOLAR ROOFTOP BECAME A NATIONAL SECURITY ISSUE

Vulnerabilities in home solar inverters pose cybersecurity risks, potentially exposing the power grid to attacks. Lax industry security, regulatory gaps, and widespread adoption have made these devices a national concern, highlighting the complexity of securing modern, distributed energy networks

techcrunch.com · 7 min

TLDR InfoSec

CISCO SECURE FIREWALL MANAGEMENT CENTER WITH CVSS 10 RCE VULNERABILITY CVE-2025-20265

A critical remote code execution vulnerability (CVSS 10) in Cisco's Firewall Management Center via RADIUS permits unauthenticated remote code execution when RADIUS authentication is enabled - apply patches immediately.

borncity.com · 3 min

TLDR InfoSec

HOTELS IN ITALY SUFFER A POTENTIALLY MASSIVE BREACH

Italian authorities confirm a major breach affecting at least 10 hotels with nearly 100,000 records for sale, including high-resolution passport and ID scans stolen via a booking system breach between June and August.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ANTHROPIC: CLAUDE CAN NOW END CONVERSATIONS TO PREVENT HARMFUL USES

Anthropic has updated its paid Claude Opus 4 and 4.1 AI models to terminate conversations if harm or abuse is detected, a feature most users will rarely encounter.

bleepingcomputer.com · 1 min