TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-06-13

5 sections14 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

GITLAB PATCHES HIGH SEVERITY ACCOUNT TAKEOVER AND MISSING AUTH ISSUES

GitLab has released patches that fix critical security issues for its Community and Enterprise versions. It fixed an HTML injection vulnerability that could allow remote attackers to take over accounts by injecting malicious code into the search page. GitLab also patched a missing authorization issue that could allow remote threat actors to inject malicious CI/CD jobs into any project's future CI/CD pipelines in GitLab Ultimate EE servers.

bleepingcomputer.com2 min read

PASSWORD-SPRAYING ATTACKS TARGET 80K MICROSOFT ENTRA ID ACCOUNTS

Researchers at Proofpoint are warning of a password-spraying attack targeting Microsoft Entra ID accounts by a threat actor called UNK_SneakyStrike. The researchers said the peak of the activity occurred on January 8, when 16.5K accounts were targeted in a single day, but the attacks have continued in short bursts since then. Proofpoint identified that the attackers were using the TeamFiltration pentesting framework based on a unique user agent that it uses and other artifacts.

bleepingcomputer.com2 min read

'MAJOR COMPROMISE' AT NHS TEMPING ARM EXPOSED GAPING SECURITY HOLES

NHS Professionals, which provides temporary staff to NHS trusts, suffered a cyberattack in May 2024 when criminals stole its Active Directory database containing user credentials. Despite claiming no data was compromised, internal reports confirm the theft. The organization lacked proper security measures like multi-factor authentication and endpoint detection systems.

theregister.com5 min read

02STRATEGIES & TACTICS

THREAT MODELLING CLOUD SERVICE PROVIDERS IN 2025

This post examines the threats posed by government pressure on cloud service providers. The simplest attack vector is for the government to force a cloud provider to deplatform an organization, resulting in a denial of service. Another vector involves the government violating confidentiality by compelling the provider to release sensitive information. This risk can be mitigated by storing critical data on-premises or using confidential computing architecture.

chrisfarris.com4 min read

MISBEHAVING MODALITIES: DETECTING TOOLS, NOT TECHNIQUES

Execution Modality is a detection engineering technique that describes how a malicious behavior is executed rather than what the malicious behavior does. Detecting Execution Modality shifts detection closer to the operating system source of truth to create a technique-agnostic detection while preserving necessary context. Given this, Kernel Event Tracing for Windows (ETW) should be considered superior to user-mode ntdll hooking.

elastic.co14 min read

“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Meta developed "localhost tracking" to bypass Android's security protections and identify users despite VPNs, incognito mode, and deleted cookies. This post dives into how it works. Meta now faces potential record fines under GDPR, DSA, and DMA regulations totaling up to €32 billion (20% of its €164 billion revenue), as penalties can be applied cumulatively across different violated regulations.

zeropartydata.es9 min read

03LAUNCHES & TOOLS

TRIAGEMCP

TriageMCP provides an MCP server to enable an LLM to perform static analysis of a PE file and basic static triage of a PE file.

github.comGitHub repository

HIRUNDO (PRODUCT LAUNCH)

Hirundo's Machine Unlearning platform, which also tackles jailbreaks, aims to address issues in the AI core without retraining the model while boosting the accuracy of non-generative applications.

hirundo.io

SECOND ORDER

This tool scans web applications for second-order subdomain takeover by crawling apps, collecting URLs (and other data) that match specific rules, or responding in a certain way.

github.comGitHub repository

04MISCELLANEOUS

WITH RETAIL CYBERATTACKS ON THE RISE, CUSTOMERS FIND ORDERS BLOCKED AND SHELVES EMPTY

Recent cyberattacks on major retailers are disrupting shopping experiences. United Natural Foods' breach affected Whole Foods' supply chains, while UK retailers like Marks & Spencer and Co-op faced weeks-long outages and empty shelves. These attacks expose customer data and highlight rising ransomware threats targeting consumer-facing businesses for maximum impact.

securityweek.com6 min read

ECHOLEAK ZERO-CLICK AI ATTACK IN MICROSOFT COPILOT EXPOSES COMPANY DATA

A new security vulnerability named EchoLeak enables hackers to extract company data from Microsoft 365 Copilot using just one email. This attack deceives the AI into violating its own protocols and divulging confidential information, all without requiring any action from the user. Experts caution that this highlights more significant risks associated with designing and using AI tools.

hackread.com3 min read