TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-08-11

6 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

threatlocker.com

02ATTACKS & VULNERABILITIES

BROSIX AND CHATOX PROMISED TO KEEP YOUR CHATS SECURED. THEY DIDN'T

Chatox and Brosix are both communications platforms for personal and team use owned by Stefan Chekanov. A security researcher discovered an unencrypted backup of chat logs containing 155.3GB of unique, compressed files containing over 65M stored messages and 73K files for Chatox and over 37M messages and 191K files for Brosix. Upon notification, the Brosix backup was secured, but the Chatox backup is still unsecured.

links.tldrnewsletter.com3 min read

WINRAR ZERO-DAY EXPLOITED TO PLANT MALWARE ON ARCHIVE EXTRACTION

Researchers from ESET discovered a new WinRAR vulnerability that is being actively exploited in phishing campaigns. Unpatched versions of WinRAR and Windows versions of UnRAR, RAR, and UnRAR.dll can be tricked into using a path specified by a maliciously crafted archive file as the extraction directory. This vulnerability is being exploited by the Russian hacking group RomCom to install malware.

bleepingcomputer.com2 min read

LINUX-BASED LENOVO WEBCAMS' FLAW CAN BE REMOTELY EXPLOITED FOR BADUSB ATTACKS

Security researchers discovered vulnerabilities in Lenovo 510 FHD and Performance FHD webcams that allow attackers to remotely transform them into BadUSB devices capable of injecting keystrokes and installing malware. The Linux-based webcams lack firmware validation, enabling complete compromise and persistent re-infection even after system wipes and OS reinstalls. Lenovo has released firmware version 4.8.0 to address the vulnerabilities following responsible disclosure in April.

links.tldrnewsletter.com4 min read

03STRATEGIES & TACTICS

REPEATER STRIKE: MANUAL TESTING, AMPLIFIED

Gareth Heyes of PortSwigger writes about his experience writing a Burp Suite AI extension to automate hunting for IDOR and similar vulnerabilities. The extension, Repeater Strike, scans requests and responses to generate regular expressions that can be used to identify vulnerabilities in your traffic. While the extension worked in small tests, the AI struggled with longer responses, creating regular expressions that aren't site specific, and detecting more complex vulnerabilities.

portswigger.net5 min read

I SPY: ESCALATING TO ENTRA ID'S GLOBAL ADMIN WITH A FIRST-PARTY APP

Researchers from DataDog discovered an attack vector where an attacker could abuse an Entra ID service principal (SP) with the Cloud Application Administrator or Application Administrator roles or the `Application.ReadWrite.All` permission to obtain global admin. The attacker uses the compromised SP to hijack the Office 365 Exchange Online SP to add a new federated domain, which they can then abuse to log in as any hybrid user. The researchers reported this vulnerability to Microsoft, but it was dismissed as a configuration issue.

securitylabs.datadoghq.com10 min read

WHY XSS PERSISTS IN THIS FRAMEWORKS ERA?

Modern frameworks block most HTML XSS through automatic escaping, but XSS persists when developers bypass protections with WYSIWYG editors, markdown parsers, or flawed sanitizers. Frameworks don't guard against JavaScript XSS via URL attributes (href/src with javascript:) or eval in OAuth flows, redirects, or postMessage. Even trusted libraries may cause XSS if misused, and defenses like CSP and WAF are often bypassed, so developers must treat all input as untrusted and reliably use protections.

flatt.tech24 min read

04LAUNCHES & TOOLS

UBLOCK ORIGIN LITE AVAILABLE FOR SAFARI

uBlock Origin Lite has been released for Safari on macOS and iOS following the discontinuation of the original uBlock Origin. uBlock Origin Lite provides best-in-class ad blocking without consuming CPU or memory resources.

howtogeek.com2 min read

0DAY.TODAY ARCHIVE

VulnCheck-OSS created a GitHub repo archiving tens of thousands of exploits from 0day.today, a public exploit database that went offline in early 2025 and returned without its decade of data. The archive categorizes exploits (DoS, local, remote, shellcode, and web apps) with an index.json file for access, including metadata like CVEs, dates, and platforms. The project aims to prevent data loss and help security researchers use historical proof-of-concepts for analysis and detection.

github.comGitHub repository

SIMPLIFY ACCESS REVIEWS WITH TRELICA BY 1PASSWORD

Trelica by 1Password introduced an access review feature that automates SaaS user access audits across 350+ API integrations, custom applications via APIs, and non-SCIM apps through CSV uploads. It offers a standardized workflow with context (roles, access levels, and issues), automated reviewer notifications, and inline actions for deactivating users or updating permissions. Reviews produce exportable audit reports with reviewer details and notes to meet compliance standards like SOC 2, SOX, PCI DSS, and ISO 27001.

blog.1password.com4 min read

05MISCELLANEOUS

API KEYS FOR BEDROCK: A BRIEF SECURITY OVERVIEW

AWS has introduced the ability to create Bedrock API keys, which are special API keys that are explicitly scoped to Bedrock. Long-term API keys are tied to an automatically generated or existing IAM user, can be configured with an expiration of up to 100 years, and are composed of a magic 3-byte prefix, a human-readable section, and a base64-encoded secret. Short-term API keys are scoped to a specific user's session and have the format `bedrock-api-key-[BASE64]` where [BASE64] is a base64-encoded pre-signed URL.

medium.com5 min read

RESEARCHERS UNCOVER GPT-5 JAILBREAK AND ZERO-CLICK AI AGENT ATTACKS EXPOSING CLOUD AND IOT SYSTEMS

Researchers from NeuralTrust demonstrated a jailbreak against GPT-5 using "Echo Chamber" and storytelling to bypass ethical guardrails, poisoning context to generate prohibited instructions without triggering refusals. Zenity Labs revealed "AgentFlayer" attacks exploiting ChatGPT Connectors, Cursor AI, and Microsoft Copilot via prompt injections in documents, tickets, or emails to exfiltrate data like API keys. These reveal how AI connected to external systems increases attack surfaces, with Tel-Aviv University showing smart home hijacking via poisoned calendar invites to Google's Gemini AI.

links.tldrnewsletter.com5 min read

KREBSONSECURITY IN NEW 'MOST WANTED' HBO MAX SERIES

Brian Krebs will be featured in a new four-part HBO Max series about Finnish cybercriminal Julius Kivimäki, who was recently sentenced to over six years for extorting a psychotherapy clinic and its patients. The series explores Kivimäki's hacking career from age 14, including DDoS attacks, swatting, and blackmailing 22,000 therapy patients. Titled "Most Wanted: Teen Hacker," it will air weekly on Fridays throughout September across multiple regions.

krebsonsecurity.com4 min read