The Daily Index — Thursday, September 25, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

STATE-SPONSORED HACKERS EXPLOITING LIBRAESVA EMAIL SECURITY GATEWAY VULNERABILITY

Libraesva has patched CVE-2025-59689, a command injection vulnerability in its Email Security Gateway with a CVSS score of 6.1, after discovering state-sponsored threat actors were actively exploiting it. The flaw can be triggered by malicious emails, allowing attackers to execute commands on the affected system. Organizations using Libraesva ESG should immediately apply the available security update to prevent exploitation.

thehackernews.com · 2 min

TLDR InfoSec

LARGE-SCALE ATTACK TARGETING MACS VIA GITHUB PAGES IMPERSONATING COMPANIES TO ATTEMPT TO DELIVER STEALER MALWARE

Attackers created fraudulent GitHub Pages impersonating over 100 companies (including LastPass, 1Password, financial institutions, and tech firms) using SEO to rank high in search results and trick Mac users into downloading fake software installers. The malicious sites redirect victims through multiple layers to ultimately execute a terminal command that downloads Atomic Stealer malware, which harvests credentials and sensitive data from infected systems. The campaign leverages trusted GitHub infrastructure and creates multiple backup repositories under different usernames to evade takedown efforts while targeting a broad range of high-value software applications.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

REDISCLOSURE: NEW TECHNIQUE FOR EXPLOITING FULL-TEXT SEARCH IN MYSQL (MYBB CASE STUDY)

Researchers have discovered a new regular expression (regex) injection method that exploits MySQL's Full-Text Search (FTS) boolean mode operators to bypass input sanitization. This technique utilizes characters like * and +, which have different meanings in FTS versus regex. The attack extracts sensitive data without breaking SQL syntax, demonstrated in CVE-2025-48941 in myBB, where attackers could enumerate deleted thread titles by observing search redirects instead of error messages. This is risky because FTS functions are often unsanitized, as developers don't view them as regular expressions, and the payloads can evade WAFs and security scanners.

exploit.az · 8 min

TLDR InfoSec

PROJECT RAIN:L1TF

L1TF Reloaded is a complex attack chain that uses half-Spectre gadgets to load data into L1 cache and L1 Terminal Fault to read cross-VM secrets via kernel data structures, breaking KASLR and extracting TLS keys. Google responded with Address Space Isolation (ASI), removing sensitive memory from kernel space during VM execution and mapping it during controlled transitions with buffer clearing. The attack highlights how speculative execution vulnerabilities can bypass privilege boundaries in virtualized environments, emphasizing the need for comprehensive architectural defenses beyond piecemeal mitigations.

bughunters.google.com · 13 min

TLDR InfoSec

BOOKWORM TO STATELY TAURUS USING THE UNIT 42 ATTRIBUTION FRAMEWORK

Palo Alto Networks' Unit 42 linked the Bookworm malware family to the Chinese APT group Stately Taurus by analyzing shared artifacts, including PDB paths, infrastructure, and targeting of Southeast Asian governments. Using the Admiralty System, they scored evidence reliability, reaching a confidence score of 58.4 based on toolsets, victim profiles, timelines from 2015-2022, and environment fingerprints. This case shows how structured attribution enables evidence-based threat actor identification, improving cybersecurity intelligence.

unit42.paloaltonetworks.com · 13 min

TLDR InfoSec

KALI LINUX 2025.3 RELEASED WITH 10 NEW TOOLS, WIFI ENHANCEMENTS

Kali Linux 2025.3 introduces ten new security tools, including Caido web security auditing toolkit, krbrelayx Kerberos exploitation framework, and AI-powered tools like Gemini CLI and llm-tools-nmap for LLM-based network scanning. The release adds Nexmon firmware patching framework support for enhanced Wi-Fi capabilities on Raspberry Pi devices, including Pi 5, enabling monitor mode and frame injection for wireless security testing. Additional updates include Kali NetHunter improvements with Samsung S10 support, CARsenal car hacking features with new UI, and experimental Magisk kernel module installation capabilities.

bleepingcomputer.com · 2 min

TLDR InfoSec

ANOTHER BRICKSTORM: STEALTHY BACKDOOR ENABLING ESPIONAGE INTO TECH AND LEGAL SECTORS

China-nexus threat actor UNC5221 uses BRICKSTORM backdoors on network appliances and VMware infrastructure to maintain persistent access, averaging 393 days undetected. The actor employs sophisticated tactics, including VM cloning to extract credentials offline, credential harvesting via BRICKSTEAL servlet filters, and legitimate tool abuse to access M365 mailboxes and secret vaults. Organizations should inventory unmonitored appliances, hunt for unusual internet traffic from management interfaces, and monitor for VM cloning activities and suspicious SSH enablement on virtualization platforms.

cloud.google.com · 12 min

TLDR InfoSec

CISA SAYS HACKERS BREACHED FEDERAL AGENCY USING GEOSERVER EXPLOIT

Attackers exploited CVE-2024-36401, a critical GeoServer RCE vulnerability, to breach a US federal agency. They maintained access for three weeks before detection. The threat actors deployed China Chopper webshells, moved laterally to web and SQL servers, and used brute force techniques for privilege escalation and credential harvesting. Organizations should prioritize patching critical vulnerabilities in CISA's KEV catalog and ensure continuous EDR monitoring, as over 16,000 GeoServer instances remain exposed online.

bleepingcomputer.com · 2 min

TLDR InfoSec

SOLARWINDS FIXES WEB HELP DESK PATCH BYPASS FOR ACTIVELY EXPLOITED FLAW — AGAIN

SolarWinds issued a third patch for the critical Java deserialization vulnerability in Web Help Desk, CVE-2025-26399 bypasses CVE-2024-28988, which bypassed the original CVE-2024-28986 flaw. This CVE affects the AjaxProxy component, allowing unauthenticated remote code execution. Trend Micro researchers found each patch bypass. Experts warn that patch bypasses are common with blacklist approaches and predict that this could be exploited, given its history of active exploitation.

csoonline.com · 2 min

TLDR InfoSec

CISA, GITHUB TAKE ACTION AFTER MASSIVE NPM SUPPLY CHAIN COMPROMISE

CISA issued an alert with eight remediation tips after the Shai-Hulud worm compromised 500+ NPM packages by stealing GitHub tokens and cloud credentials. GitHub responded by enforcing stricter authentication, including mandatory 2FA for publishing and switching to trusted methods with short-lived tokens.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKERS CLAIM GERMAN AVIATION FIRM, LEAK CUSTOMER DATA

The J Group ransomware gang claims to have breached FAI Aviation Group, a German charter operator, stealing nearly 3TB of sensitive data, including patient records, employee documents, audit files, CVs, and passport copies, and threatening to sell the data after failed ransom talks.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

POKEMON FANS BEG CREATORS TO SUE THE US GOVT FOR "GOTTA CATCH 'EM ALL" ICE PROPAGANDA

The Department of Homeland Security (DHS) made a viral video with Pokémon images, music, and the "Gotta Catch 'Em All" slogan to promote ICE raids, showing detained immigrants as Pokémon cards and outraging fans who called on Nintendo to sue for unauthorized use.

links.tldrnewsletter.com · 2 min