The Daily Index — Friday, August 22, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

APPLE PATCHES CVE-2025-43300 ZERO-DAY IN IOS, IPADOS, AND MACOS EXPLOITED IN TARGETED ATTACKS

Apple has patched CVE-2025-43300, a zero-day exploit in the ImageIO framework that causes memory corruption via malicious images. It affected iOS 18.6.2, iPadOS 18.6.2/17.7.10, and macOS Ventura 13.7.8, Sonoma 14.7.8, and Sequoia 15.6.1. This is Apple's seventh zero-day patch in 2025.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

TPG TELECOM ESTIMATES 280K AFFECTED BY SUBSIDIARY BREACH

TPG Telecom's subsidiary iiNet suffered a data breach due to a stolen employee login, exposing the data of around 280,000 customers. The exposed information includes emails, phone numbers, addresses, and some setup passwords. The breach was contained, and affected customers are being notified.

theregister.com · 2 min

TLDR InfoSec

RUSSIA-LINKED EUROPEAN ATTACKS RENEW CONCERNS OVER WATER CYBERSECURITY

Russian hackers probably sabotaged a Norwegian dam in April by remotely opening valves for four hours. Poland also reported a thwarted cyberattack that could have cut water to a major city. These attacks, linked to groups like Z-Pentest Alliance, show water facilities as vulnerable targets that could lead to bigger threats. Water utilities should boost cybersecurity with more funding, consulting, or free resources like the DEF CON Franklin project.

csoonline.com · 5 min

TLDR InfoSec

SPYVPN: THE GOOGLE-FEATURED VPN THAT SECRETLY CAPTURES YOUR SCREEN

FreeVPN.One, a popular VPN Chrome extension, secretly takes screenshots of users' browsing—including sensitive info—and uploads them to the developer's servers without consent. Despite claiming to protect privacy, it abuses permissions, uses encryption to evade detection, and provides misleading explanations, exposing security flaws in Chrome extensions.

koi.security · 7 min

TLDR InfoSec

“SCAMLEXITY” WE PUT AGENTIC AI BROWSERS TO THE TEST - THEY CLICKED, THEY PAID, THEY FAILED

As AI browsers like Comet take over online tasks, they're dangerously vulnerable to scams and prompt injections, sometimes making purchases or clicking harmful links without user awareness. Traditional fraud techniques and new AI-targeted tricks can easily fool agentic AI, making users pay the price. Security must be built into AI browsers from the ground up, not treated as an afterthought, to protect users in this new era of automated scamming.

guard.io · 9 min

TLDR InfoSec

COPILOT BROKE YOUR AUDIT LOG, BUT MICROSOFT WON'T TELL YOU

Microsoft's Copilot AI allowed users to access files in M365 without leaving audit log records, creating potential security and compliance risks. This was reported to Microsoft, which quietly fixed the issue but chose not to notify customers or issue a formal security alert. Any organization using Copilot before August 18 may have incomplete audit logs and might be unaware of what happened.

pistachioapp.com · 8 min

TLDR InfoSec

HACKERS WHO EXPOSED NORTH KOREAN GOVERNMENT HACKER EXPLAIN WHY THEY DID IT

Two ethical hackers accessed a North Korean state hacker's computer for months and uncovered evidence of cyberespionage and theft. They leaked their findings to support cyber defense and expose government-backed hacking activities, hoping their action would inspire more transparency and accountability in global cybersecurity.

techcrunch.com · 3 min

TLDR InfoSec

YOU DON'T NEED A VENDOR TO AUTOMATE SECURITY QUESTIONNAIRES

Security questionnaires are a standard part of the security review process that can often be tedious, time-consuming, and mechanical for vendors' teams. Instead of buying a tool to handle this process, vendors can either build their own RAG or use Claude/ChatGPT. To use Claude/ChatGPT, prepare a folder with the relevant documents that would be included in a Trust Center, as well as some previously manually completed questionnaires.

blog.marcolancini.it · 7 min

TLDR InfoSec

PHARMACEUTICAL FIRM INOTIV DISCLOSES RANSOMWARE ATTACK. QILIN GROUP CLAIMS RESPONSIBILITY FOR THE HACK

Inotiv, a pharmaceutical research company, was hit by a ransomware attack attributed to the Qilin group that disrupted operations and potentially exposed data.

securityaffairs.com · 1 min

TLDR InfoSec

MICROSOFT REMINDS THAT WINDOWS 10 SUPPORT WILL END IN TWO MONTHS

Windows 10 support will end in October, after which the operating system will no longer receive security updates unless users purchase Extended Security Updates or upgrade to Windows 11.

bleepingcomputer.com · 1 min

TLDR InfoSec

EUROPOL SAYS QILIN RANSOMWARE REWARD FAKE

Europol has denied offering a $50,000 reward for help capturing Qilin ransomware members, calling the announcement in a Telegram group a scam.

securityweek.com · 1 min