The Daily Index — Thursday, November 13, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

AMAZON DISCOVERS APT EXPLOITING CISCO AND CITRIX ZERO-DAYS

Amazon's threat intelligence team discovered an APT exploiting zero-day vulnerabilities CVE-2025-20337 in Cisco Identity Service Engine (pre-authentication RCE via deserialization) and CVE-2025-5777 in Citrix systems. The attacks were detected via MadPot honeypots before public disclosure. The threat actor deployed a custom Java web shell named IdentityAuditAction, which features in-memory operation, Java reflection for thread injection, DES encryption with non-standard Base64 encoding, and HTTP header-based authentication requiring specific knowledge to access. Organizations should immediately patch affected Cisco ISE and Citrix NetScaler systems, implement firewall restrictions on management portal access, deploy defense-in-depth strategies for identity infrastructure, and monitor for anomalous behavior patterns in authentication systems even when properly configured.

aws.amazon.com · 2 min

TLDR InfoSec

SYNOLOGY FIXES BEESTATION ZERO-DAYS DEMOED AT PWN2OWN IRELAND

Synology has fixed a critical vulnerability in its BeeStation OS, which powers Synology NAS devices, discovered by researchers at Pwn2Own Ireland. A buffer overflow causes the vulnerability and can result in remote code execution.

bleepingcomputer.com · 2 min

TLDR InfoSec

NO LEAK, NO PROBLEM - BYPASSING ASLR WITH A ROP CHAIN TO GAIN RCE

A showcase on how to exploit a modern ARM-based IoT device, specifically a network camera, by bypassing Address Space Layout Randomization (ASLR) to achieve unauthenticated remote code execution (RCE) using a Return-Oriented Programming (ROP) chain. This approach cleverly bypasses ASLR, a memory protection mechanism designed to block exploit attempts, allowing remote code execution without requiring the leakage of addresses. By manipulating writable memory and leveraging known offsets, the attacker can execute commands on the device, illustrating how gaps in embedded device security can be exploited even with mitigations in place.

modzero.com · 10 min

TLDR InfoSec

ACTIVE DIRECTORY UNDER SIEGE: WHY CRITICAL INFRASTRUCTURE NEEDS STRONGER SECURITY

Active Directory remains the authentication backbone for 90% of Fortune 1000 companies, with attackers exploiting golden ticket attacks, DCSync privilege escalation, Kerberoasting, and compromised credentials (involved in 88% of breaches per Verizon DBIR) to gain network-wide control, as demonstrated by the 2024 Change Healthcare breach, where MFA absence enabled full AD compromise. Critical vulnerabilities include weak passwords, service accounts with excessive permissions and non-expiring credentials, cached admin credentials in memory, legacy NTLM protocol exploitation, and hybrid environment complexity, creating visibility gaps between on-premises and cloud security teams. Implement layered defenses, including continuous credential monitoring against breach databases (blocking 4B+ compromised passwords), privileged access management with just-in-time elevation, zero-trust conditional access with MFA for all privileged accounts, continuous AD change monitoring for suspicious patterns, and aggressive patching of domain controllers within days of security updates.

thehackernews.com · 3 min

TLDR InfoSec

TWO SCENARIO THREAT MODELING

Many people feel intimidated by the number of potential scenarios and never perform threat modeling. Instead, many of the insights of a threat modeling exercise can be garnered by considering only a worst case scenario and a likely but impactful scenario. Security teams should devise detailed story-driven scenarios for these exercises and then proceed in either an informal or formal threat modeling exercise.

jacobian.org · 5 min

TLDR InfoSec

TENZAI (PRODUCT LAUNCH)

Tenzai is an AI-driven penetration testing platform that continuously identifies and addresses software vulnerabilities, aiming to automate manual and infrequent pentesting.

tenzai.com

TLDR InfoSec

PRIVATE AI COMPUTE: OUR NEXT STEP IN BUILDING PRIVATE AND HELPFUL AI

Private AI Compute is a Google platform that enhances AI privacy by combining the power of advanced Gemini cloud models with on-device security standards. This approach ensures users' data is kept private while unlocking fast, intelligent features like smarter suggestions. The system uses encrypted, hardware-secured spaces and multi-layered safeguards, allowing advanced AI without compromising personal data privacy.

blog.google · 2 min

TLDR InfoSec

AUSTRALIA'S SPY BOSS SAYS AUTHORITARIAN NATIONS READY TO COMMIT ‘HIGH-IMPACT SABOTAGE'

Australia's intelligence chief warns that authoritarian states are increasingly willing and able to sabotage critical infrastructure via cyber-attacks. He cites Chinese hacker groups probing Australian networks, and highlights a shift from espionage to disruptive actions that could cripple essential services.

theregister.com · 2 min

TLDR InfoSec

AWS BACKUP NOW SUPPORTS AMAZON EKS

AWS Backup now allows for creating fully managed backups of EKS clusters. It supports scheduled backups, data retention, immutable vaults, and cross-region and cross-account copies for application data and cluster state.

aws.amazon.com · 1 min

TLDR InfoSec

MICROSOFT PATCH TUESDAY SECURITY UPDATES FOR NOVEMBER 2025 FIXED AN ACTIVELY EXPLOITED WINDOWS KERNEL BUG

Microsoft's November 2025 Patch Tuesday addressed 63 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel race condition enabling local privilege escalation to SYSTEM, and CVE-2025-62199, a use-after-free RCE in Microsoft Office.

securityaffairs.com · 2 min

TLDR InfoSec

MALICIOUS NPM PACKAGE SNEAKS INTO GITHUB ACTIONS BUILDS

A typosquatted npm package named "@acitons/artifact," with 260K downloads, targeted GitHub Actions CI/CD pipelines through a post-install hook that ran obfuscated shell scripts to steal tokens and impersonate GitHub by publishing malicious artifacts.

csoonline.com · 2 min

TLDR InfoSec

@FACEBOOKMAIL.COM INVITES EXPLOITED TO PHISH FACEBOOK BUSINESS USERS

Attackers sent 40,000 phishing emails to 5,000 Facebook Business users by exploiting Meta's invitation feature to send credential-harvesting links from @facebookmail.com, targeting SMBs in various sectors with fake invites that redirected to phishing pages which mimicked Meta branding.

hackread.com · 2 min