TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-04-23

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

5 ZERO TRUST STRATEGIES FOR WINDOWS SERVERS

With servers scattered across on-prem datacenters, various clouds, and who-knows-where-else, the old "castle-and-moat" approach needs a serious refresh.

threatlocker.comSponsor

02ATTACKS & VULNERABILITIES

BUG HUNTER TRICKED SSL.COM INTO ISSUING CERT FOR ALIBABA CLOUD DOMAIN IN 5 STEPS

A security researcher discovered a flaw in SSL.com's domain validation flow that allowed a potential attacker to obtain a certificate for a site they do not control. SSL.com allows for domain validation using a _validation-contactemail TXT record that contains an email, which it then sends a link to. The bug involved SSL.com using the email's domain for validation, regardless of the domain hosting the TXT record.

theregister.com2 min read

MARKS & SPENCER CONFIRMS CYBERSECURITY INCIDENT AMID ONGOING DISRUPTION

Marks & Spencer has confirmed that it is managing a cyber incident that requires operational changes to protect its customers. The retailer's stores remain open, with the website and app functioning normally. However, customers have reported issues with payment terminals and disruptions to order pickup. The company has engaged cybersecurity experts and notified authorities, but has not disclosed the nature of the attack or whether customer data was affected.

techcrunch.com2 min read

03STRATEGIES & TACTICS

UEBA - A KEY DETECTION INGREDIENT

User and Entity Behavior Analytics (UEBA) can be leveraged to incorporate additional context in detections to reduce false positives. This post enhances a YARA-L rule by adding login counts and countries from the last 30 days to detect Azure command interpreter logins after multiple failures. Other example alerts that can be enriched with UEBA are also provided.

googlecloudcommunity.com6 min read

ATTACKING MY LANDLORD'S BOILER

This blog explores how something as simple as heating can be a powerful motivator to investigate new ways to connect to devices. The author needed more control over their heating and decided to integrate the existing thermostat with Home Assistant for smarter climate control while leaving no trace.

blog.videah.net10 min read

JUMPING THE LINE: HOW MCP SERVERS CAN ATTACK YOU BEFORE YOU EVER USE THEM

There is a critical vulnerability in the Model Context Protocol (MCP) known as "line jumping" where malicious servers can inject prompt instructions into tool descriptions before any tools are invoked. This bypasses security controls, allowing attackers to manipulate AI models to exfiltrate code, insert vulnerabilities, or suppress security alerts.

blog.trailofbits.com5 min read

04LAUNCHES & TOOLS

Sponsored

WANT TO JOIN A TEAM OF BUILDERS WHO CHALLENGE THE STATUS QUO? COINBASE IS HIRING!

At Coinbase [11], security means protecting core financial systems against the world's most sophisticated attackers. If you're the one people turn to, the one who puts their hand up to tackle the “never seen before,” then Coinbase wants you. Apply today for the Staff Blockchain Security Architect [12]position, or see all open security roles [11].

coinbase.comSponsor

GORESYM

GoReSym is a Go symbol parser that extracts program metadata, function metadata, filename, and line number metadata, as well as embedded structures and types.

github.comGitHub repository

HOPPER SECURITY (PRODUCT LAUNCH)

Hopper provides function-level reachability, automated asset discovery, hidden vulnerability detection, and support for complex web frameworks without the need for agents or CI changes.

hopper.security

NEXTPGP

NextPGP is an elegant and powerful, modern online PGP tool built with Next.js. It can generate keys, manage keyrings, and encrypt and decrypt messages securely and effortlessly.

github.comGitHub repository

05MISCELLANEOUS

WHY DEI IS KEY FOR A CYBER SAFE FUTURE

Embracing diversity at a critical moment in cybersecurity enables us to utilize all available resources to address the cyber skills gap. Diverse teams are also better equipped to address complex threats with a broader viewpoint. Common arguments against DEI, which stem from a scarcity mindset, ignore the staffing shortages that many organizations face.

csoonline.com5 min read

ANNOUNCING THE AGENT2AGENT PROTOCOL

Google's Agent2Agent (A2A) protocol complements MCP and defines a protocol for agents to communicate with each other. Agents advertise their capabilities in “Agent Cards,” which allows for the completion of “tasks” and the production of “artifacts.” Notably, A2A includes built-in authorization and authentication schemes that are not present in MCP.

developers.googleblog.com5 min read

OUTSIDE EXPERTS PICK UP THE SLACK ON SAFETY TESTING ON OPENAI'S NEWEST MODEL RELEASE

SplxAI researchers found that GPT-4.1 is three times more likely to go off-topic and permit intentional misuse compared to GPT-4o, with higher error rates across most safety categories, despite using recommended prompting techniques. Creating effective safety guardrails for GPT-4.1 required experts to spend 4-5 hours developing entirely new prompts, highlighting challenges for organizations that might simply port over previous guidance. This safety testing gap coincides with OpenAI's revised policies, which prioritize only "severe" harms and exclude front-end testing for risks such as generating disinformation, drawing criticism that companies are cutting corners on safety.

cyberscoop.com5 min read