TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-06-05

6 sections14 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

HEWLETT PACKARD ENTERPRISE WARNS OF CRITICAL STOREONCE AUTH BYPASS

Hewlett Packard Enterprise (HPE) has patched eight significant security vulnerabilities in its StoreOnce backup software. A critical flaw enables attackers to bypass login checks and gain system access. HPE recommends that all users promptly upgrade to version 4.3.11 to protect against these issues.

bleepingcomputer.com2 min read

MALICIOUS RUBYGEMS POSE AS FASTLANE TO STEAL TELEGRAM API DATA

Researchers at Socket identified two malicious Ruby gems impersonating the fastlane-plugin-telegram gem, which is used for sending CI/CD updates from Fastlane to a Telegram channel. The typosquatted gems are nearly identical to the legitimate gem except that they redirect Telegram API calls to an attacker-controlled server. Any bot tokens that were used in builds with the malicious gems should be considered compromised.

bleepingcomputer.com2 min read

35K SOLAR POWER SYSTEMS EXPOSED TO THE INTERNET

Cybersecurity researchers at Forescout have discovered that roughly 35k solar power systems are internet exposed. These devices were found by searching on Shodan and many are vulnerable to existing exploits.

securityweek.com2 min read

03STRATEGIES & TACTICS

HOW I USED O3 TO FIND CVE-2025-37899, A REMOTE ZERO-DAY VULNERABILITY IN THE LINUX KERNEL'S SMB IMPLEMENTATION

A security researcher used OpenAI's o3 model to find CVE-2025-37899, a previously unknown zero-day use-after-free vulnerability in the Linux kernel's SMB implementation (ksmbd). The flaw occurs when one thread frees a session user object while another thread on a concurrent connection is still accessing it, leading to potential kernel memory corruption. This represents the first documented case of an LLM discovering a vulnerability requiring complex reasoning about concurrent execution paths, demonstrating that o3 has achieved a significant breakthrough in automated code analysis capabilities that can be utilized for bug hunting.

sean.heelan.io10 min read

PATCHGUARD INTERNALS

PatchGuard (Kernel Patch Protection) is a Windows kernel mitigation introduced in 2005 that monitors critical kernel structures like IDT, GDT, MSRs, and SSDT, triggering a BSOD with error code 0x109 for unauthorized modifications. It employs randomized activation methods, such as timers and hidden DPCs, making its behavior unpredictable and hard to reverse engineer. Bypasses exist through boot-time patches and hypervisor-based rootkits that use Extended Page Tables (EPT) to hide changes, but both require disabling Secure Boot.

r0keb.github.io30 min read

04LAUNCHES & TOOLS

Sponsored

FREE SHADOW AI INVENTORY

Who's using AI tools in your org? Find out today with a free trial of Nudge Security [11]. Within minutes, you'll have a full list of every AI app, account, and integration along with a security profile for each tool. Get your free shadow AI inventory today [11]!

nudgesecurity.comSponsor

THE CLOUD HUNTING GAMES (WEB APP)

The Cloud Hunting Games is a capture-the-flag game developed by Wiz in which players investigate a simulated cloud ransomware attack.

cloudhuntinggames.com

AUTOPWNKEY

AutoPwnKey is a red-teaming framework and testing tool that utilizes AutoHotKey for evasion.

github.comGitHub repository

FOSS TOOLS FOR INFRASTRUCTURE TESTING

A collection of open-source tools to test infrastructure. The highlighted tools include DNS tools, SSL/TLS tools, and mail servers.

bitfehler.srht.site3 min read

05MISCELLANEOUS

SMART CARS, DUMB PASSWORDS: AUTO INDUSTRY STILL RUNS ON WEAK PASSWORDS

Many car companies rely on weak and reused passwords like "123456" for system security, making them vulnerable to hackers. This lax security puts smart cars and sensitive company data at risk. Experts recommend stronger passwords, employee training, and multi-factor authentication to enhance protection against cyberattacks.

hackread.com2 min read

MICROSOFT WANTS WINDOWS UPDATE TO HANDLE ALL APPS

Microsoft has announced that it is opening up the Windows Update system to developers via a new orchestration platform. Hooking into the Windows Update orchestration platform will allow developers to take advantage of scheduled updates based on user activity, battery status, and even sustainable energy timing. Developers can also make use of the Windows Update notifications.

theverge.com3 min read