The Daily Index — Friday, September 19, 2025

GENERAL

TLDR InfoSec

Manager by G2 + CNET. Try Bitwarden for Business, free

Summary unavailable

bitwarden.com

TLDR InfoSec

NEARLY 250,000 IMPACTED BY DATA BREACH AT MEDICAL ASSOCIATES OF BREVARD

Medical Associates of Brevard in Florida revealed that a data breach in January affected almost 247,000 patients and exposed sensitive health and personal data. The BianLian ransomware group claimed responsibility for stealing information like emails and HR documents, but it remains unclear how the stolen data has been used.

securityweek.com · 2 min

TLDR InfoSec

INSIGHT PARTNERS: RANSOMWARE HIT EXPOSED DATA ON 12K PEOPLE

Venture firm Insight Partners suffered a ransomware attack that exposed data of over 12,000 staff and investors. The breach began in October 2024, leading to data encryption in January before being detected. The stolen data includes personal, banking, and tax details.

theregister.com · 2 min

TLDR InfoSec

DETECT SECRETS IN GITLAB CI LOGS USING GGSHIELD AND BRING YOUR OWN SOURCE

GitGuardian demonstrates how to automatically scan GitLab CI/CD pipeline logs for secrets using ggshield and their Bring Your Own Source initiative, addressing a critical but often overlooked attack vector where sensitive data like environment variables, API responses, and temporary credentials are exposed in build logs. The solution involves creating a custom Docker image with enhanced ggshield capabilities, configuring secure token storage via HashiCorp Vault, and implementing an automated scanning script that processes all pipeline job logs and creates incidents in the GitGuardian dashboard. This approach provides comprehensive secrets detection across the entire DevOps lifecycle, catching runtime secrets that traditional source code scanning misses while maintaining zero friction for developers.

blog.gitguardian.com · 4 min

TLDR InfoSec

AWS AGENTCORE: THE OVERLOOKED PRIVILEGE ESCALATION PATH IN BEDROCK'S AI TOOLING

AWS Bedrock AgentCore is a collection of tools that assist in deploying and scaling AI agents. AgentCore provides the ability to launch Code Interpreters, which run code in a sandboxed environment and can be customized to have access to AWS credentials to perform actions on AWS resources. Custom Code Interpreters cannot be protected with resource policies and only emit CloudTrail data events, presenting a tempting privilege escalation vector for attackers.

sonraisecurity.com · 6 min

TLDR InfoSec

LATERAL MOVEMENT - BITLOCKER

BitLocker is a full disk encryption feature for Windows that protects data at rest by encrypting full volumes. This post outlines a privilege escalation or lateral movement technique that uses Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker using remote manipulation of BitLocker registry keys to execute code under the user's context on a target host. The post also discusses detection opportunities for this attack and Sigma and Windows Defender for Endpoint queries to detect them.

ipurple.team · 8 min

TLDR InfoSec

CHECK POINT ACQUIRES LAKERA TO BUILD A UNIFIED AI SECURITY STACK

Check Point has announced plans to acquire AI security platform Lakera in Q4 2025 to strengthen enterprise defenses against emerging AI threats like prompt injection attacks, data leaks through LLMs, and model manipulation as organizations rapidly adopt generative AI and autonomous agents. Lakera's AI-native runtime protection technology boasts 98% detection rates with sub-50ms latency and less than 0.5% false positives, addressing gaps that traditional cybersecurity tools cannot handle in real-time AI environments.

csoonline.com · 4 min

TLDR InfoSec

WATCHGUARD WARNS OF CRITICAL VULNERABILITY IN FIREBOX FIREWALLS

WatchGuard has released security updates to address a critical (CVSS 9.3) remote code execution vulnerability impacting its Firebox firewalls. The vulnerability is caused by an out-of-bounds write on devices configured to use IKEv2 VPN. Devices that have deleted the vulnerable configuration but still have a branch office VPN to a static gateway peer configured may also be vulnerable.

bleepingcomputer.com · 2 min

TLDR InfoSec

MEET SHADOWLEAK: ‘IMPOSSIBLE TO DETECT' DATA THEFT USING AI

Researchers at Radware discovered a vulnerability called ShadowLeak that exploits OpenAI's ChatGPT through indirect prompt injection attacks. Hidden email instructions can trick the AI into stealing sensitive data like credit card numbers and names from users' inboxes. The attack bypasses ChatGPT's security protections by encoding stolen data in Base64 and exfiltrating it directly through OpenAI's servers via the agent's browsing tool, making it nearly impossible to detect since it doesn't go through the client interface. This attack represents a significant escalation from previous client-side prompt injection attacks, as the data theft occurs entirely on the backend without any visible signs to the user.

csoonline.com · 8 min

TLDR InfoSec

INSIDE THE 2025 SECURITY OPERATIONS REPORT: WHAT 330 TRILLION DATA POINTS REVEAL ABOUT MODERN CYBER RISK

Adversaries are accelerating their tactics, with over half of security alerts now occurring outside business hours.

arcticwolf.com · 4 min

TLDR InfoSec

TRUMP ADMIN SAYS SOCIAL SECURITY DATABASE WASN'T “LEAKED, HACKED, OR SHARED”

The Trump administration denied allegations by a whistleblower that Social Security data was moved to an insecure cloud system.

arstechnica.com · 2 min

TLDR InfoSec

JAGUAR LAND ROVER TO PAUSE PRODUCTION FOR THIRD WEEK DUE TO CYBERATTACK

Jaguar Land Rover will extend its vehicle production shutdown into a third week following a cyberattack earlier this month.

techcrunch.com · 2 min