The Daily Index — Monday, December 22, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NEW UEFI FLAW ENABLES PRE-BOOT ATTACKS FROM GIGABYTE, MSI, ASUS, ASROCK

Researchers from Riot Games discovered a UEFI flaw that could allow for Direct Memory Access (DMA) capable devices to load before the operating system. DMA allows for PCIe devices to read and write RAM without going through the CPU and relies upon IOMMU for protection. A physically present attacker would need to attach a rogue PCIe device before boot to exploit this vulnerability.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW CRITICAL WATCHGUARD FIREBOX FIREWALL FLAW EXPLOITED IN ATTACKS

WatchGuard is warning users to patch a critical, actively exploited remote code execution vulnerability in its Firebox firewalls. The vulnerability is caused by an out-of-bounds write that allows unauthenticated attackers to execute remote code. Firebox firewalls are only vulnerable if they are configured to use IKEv2, or in some circumstances, even if the configuration was deleted.

bleepingcomputer.com · 2 min

TLDR InfoSec

TP-LINK TAPO C200: HARDCODED KEYS, BUFFER OVERFLOWS AND PRIVACY IN THE ERA OF AI ASSISTED REVERSE ENGINEERING

A security researcher documented AI-assisted firmware analysis of TP-Link Tapo C200 cameras using tools including Grok, GhidraMCP, and Claude Sonnet 4. They discovered hardcoded SSL private keys that enabled HTTPS traffic decryption, pre-authentication memory overflows, integer overflow crashes, and unauthenticated WiFi hijacking, affecting approximately 25,000 internet-exposed devices. The vulnerabilities enabled remote attackers to decrypt camera traffic, crash devices, force connections to malicious networks, and enumerate nearby WiFi BSSIDs for precise geolocation via Apple's location services API. TP-Link delayed patching beyond its 90-day commitment despite being a CVE Numbering Authority, raising concerns about vendor conflicts of interest when controlling their own vulnerability disclosure pipeline while marketing low CVE counts as a competitive advantage.

evilsocket.net · 18 min

TLDR InfoSec

MISTRUSTED ADVISOR: EVADING DETECTION WITH PUBLIC S3 BUCKETS AND POTENTIAL DATA EXFILTRATION IN AWS

Researchers from Fog Security discovered three methods to bypass AWS Trusted Advisor and expose S3 buckets without triggering alerts. The three methods are to create a bucket policy that denies s3:GetBucketPolicyStatus, s3:GetBucketPublicAccessBlock, and s3:GetBucketAcl. Fog Security coordinated disclosure with AWS, but noted that it took AWS two attempts to fix the vulnerability and felt that AWS's communication downplayed the severity.

fogsecurity.io · 5 min

TLDR InfoSec

HOW GOOGLE DOES IT: BUILDING AGENTS FOR CYBERSECURITY AND DEFENSE

When introducing agentic AI to its cybersecurity teams, Google began by building trust in generative AI by adding chat interfaces to existing tools. Google security then identified initial use cases for distillation and translation, focusing on bottlenecks that AI could alleviate. The team then established and monitored KPIs as they scaled their program.

cloud.google.com · 6 min

TLDR InfoSec

ANNOUNCING GOTATUN, THE FUTURE OF WIREGUARD AT MULLVAD VPN

Mullvad's GotaTun is a Rust-based WireGuard implementation forked from Cloudflare's BoringTun that replaces wireguard-go, eliminating 85% of Android app crashes attributed to the Go implementation's FFI complexity and opaque runtime debugging challenges. The Android rollout in November reduced the user-perceived crash rate from 0.40% to 0.01%, with zero GotaTun-originated crashes, while improving connection speeds and battery efficiency through safe multithreading and zero-copy memory strategies. Mullvad plans a third-party security audit in early 2026 before expanding the GotaTun deployment to desktop and iOS platforms, maintaining full WireGuard protocol compatibility while supporting privacy features, including DAITA and Multihop.

mullvad.net · 3 min

TLDR InfoSec

DISMANTLING DEFENSES: TRUMP 2.0 CYBER YEAR IN REVIEW

The Trump administration systematically dismantled federal cybersecurity infrastructure: CISA lost 1/3 of its workforce and faces $491M budget cuts, the Cyber Safety Review Board was dissolved mid-investigation of Chinese telecom intrusions, and both NSA and Cyber Command have operated without leadership since April. DOGE accessed sensitive federal databases from SSA, DHS, OPM, and Treasury by circumventing security controls and audit mechanisms, with data exfiltration coinciding with Russian login attempts using valid DOGE credentials. Security professionals should prepare for degraded federal threat intelligence sharing after the elimination of CIPAC and MS-ISAC funding, reduced public-private coordination as agencies canceled meetings with infrastructure operators, and increased foreign intelligence recruitment of laid-off federal employees with security clearances.

krebsonsecurity.com · 20 min

TLDR InfoSec

DEFENSE BILL ADDRESSES SECURE PHONES, AI TRAINING, CYBER TROOPS' MENTAL HEALTH

In addition to $901B in funding, the 2026 National Defense Authorization Act (NDAA) also includes a series of new cybersecurity policies. The NDAA includes a provision that secure phones provided to senior leaders meet a set of security requirements, such as data encryption. The act also includes increased mental health provisions and training initiatives around AI security.

cyberscoop.com · 2 min

TLDR InfoSec

MINISTERS CONFIRM BREACH AT UK FOREIGN OFFICE BUT DETAILS REMAIN MURKY

UK ministers acknowledge a confirmed cyberattack on the Foreign Office, first reported by The Sun and widely linked in the media to Chinese state-backed hackers, though officials stress those claims are speculative. They say a technical flaw at one site was quickly closed and insist there is currently low risk to individuals, despite concerns about possible exposure of visa application data and growing warnings over China's broader cyber-espionage activity in Europe.

theregister.com · 2 min

TLDR InfoSec

UKRAINIAN NATIONAL PLEADS GUILTY TO CONSPIRACY TO USE NEFILIM RANSOMWARE TO ATTACK COMPANIES IN THE UNITED STATES AND OTHER COUNTRIES

Ukrainian national Artem Stryzhak pleaded guilty to conspiracy charges for deploying Nefilim ransomware against US companies.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

UNIVERSITY OF SYDNEY DATA BREACH AFFECTS 27,000 INDIVIDUALS

Hackers accessed an online code library at the University of Sydney that contained historical test data files.

securityweek.com · 2 min