TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-10-08

6 sections21 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

STOP REPLACING IDPS THAT ALREADY WORK

You don't need to migrate off Google Workspace to get stronger access control. If your IdP already handles authentication, the real gaps are after login—who (or what) can access what, when, and why. Switching IdPs often adds cost and friction but does little to fix privilege sprawl. Opal [5] sits on top of your existing stack, automating just-in-time access, audit trails, and review workflows [6] so you can enforce least privilege without touching authentication or disrupting users. It's how teams like CLOUDFLARE, DATABRICKS, FIGMA, PERPLEXITY, and RUNWAY strengthen identity security with the IdPs they already use.

opal.devSponsor

02ATTACKS & VULNERABILITIES

DATA BREACH AT DOCTORS IMAGING GROUP IMPACTS 171,000 PEOPLE

Doctors Imaging Group, a Florida-based radiology provider, reported a breach where hackers accessed their network for several days in November 2024. Over 171,000 people had personal and medical data compromised, including Social Security and account numbers.

securityweek.com2 min read

REDIS WARNS OF CRITICAL FLAW IMPACTING THOUSANDS OF INSTANCES

The Redis security team has released patches for a new critical (CVSS 10/10) vulnerability that could allow attackers to gain remote code execution. The vulnerability is caused by a 13-year-old use-after-free vulnerability that can be exploited by authenticated threat actors using a specially crafted Lua script. Redis recommends that administrators patch their servers and, to secure their instances further, they can enable authentication, disable Lua scripting and other unnecessary commands, launch Redis as a non-root user, and enable Redis logging.

bleepingcomputer.com2 min read

THE SALESLOFT-DRIFT BREACH: ANALYZING THE BIGGEST SAAS BREACH OF 2025

The biggest SaaS security incident in 2025 exploited the integration between Salesloft and Drift, compromising over 700 companies. Attackers abused OAuth tokens and SaaS-to-SaaS connections to move laterally, bypassing traditional security defenses and harvesting sensitive credentials. The supply chain nature of the breach allowed a single compromise to spread rapidly across interconnected apps like Salesforce and Gmail, amplifying its impact.

reco.ai6 min read

03STRATEGIES & TACTICS

FANTASTIC AWS POLICIES AND WHERE TO FIND THEM

AWS presents a large surface of IAM policies that are available across principal policies, resource policies, AWS Resource Access Manager, resource control policies, and IAM Identity Center permission sets. This post provides a listing and explanation of many of these policies, as well as introducing a new tool called iam-collect. iam-collect can download all IAM policies across every account in an organization for analysis and also provides a set of agent instructions that can be used with an LLM to explore the data further.

iam.cloudcopilot.io10 min read

FLIPSWITCH: A NOVEL SYSCALL HOOKING TECHNIQUE

FlipSwitch is a novel Linux rootkit technique that bypasses kernel 6.9's new syscall dispatch mechanism by directly patching machine code in the x64_sys_call function rather than overwriting the traditional sys_call_table. The technique locates specific call instructions within the kernel dispatcher and modifies their 4-byte offsets to redirect syscalls to malicious functions, demonstrating how attackers adapt to kernel hardening measures. This research highlights the ongoing arms race between Linux kernel security improvements and rootkit evolution. Elastic has provided YARA signatures to detect this proof-of-concept implementation.

elastic.co9 min read

AN IN-DEPTH RESEARCH-BASED WALK-THROUGH OF AN UNINITIALIZED LOCAL VARIABLE STATIC ANALYZER

Cybervelia researchers developed a Binary Ninja engine-based static analyzer that detects uninitialized local variables (ULVs) in stripped binaries by reconstructing stack layouts, tracking read-before-write patterns through Medium-Level IL analysis, and implementing interprocedural taint propagation to trace data flows across function calls. The tool addresses the challenge that modern compiler optimizations obscure ULVs in binaries, despite improved source-level detection, by utilizing techniques such as neighbor-offset heuristics for size inference and proximity-based coverage analysis to identify genuine vulnerabilities. The analyzer integrates IDA Pro symbol importing and Intel PIN execution tracing to reduce false positives and focus on actually executed code paths, demonstrating that ULV detection remains relevant even in modern binaries with recent Linux kernel vulnerabilities serving as examples.

blog.cybervelia.com19 min read

04LAUNCHES & TOOLS

Sponsored

👼 A CLOUD FIREWALL YOU DON'T NEED TO BABYSIT

Firewall rules get incredibly complex and can become a major distraction (and threat) for leaner teams. Intrusion Shield for AWS [13] uses decades of trusted threat intelligence to block risky network traffic automatically. Every malicious connection attempt is instantly turned into a firewall rule, with no action required from

intrusion.comSponsor

SETUPHIJACK

SetupHijack is a tool that exploits race conditions and insecure file handling in Windows installer and update processes.

github.comGitHub repository

FILIGRAN (PRODUCT LAUNCH)

Filigran unifies threat intelligence, attack surface, and security risk analysis, featuring OpenCTI and OpenBAS for intelligence operations and adversary emulation.

filigran.io

INTRODUCING CODEMENDER: AN AI AGENT FOR CODE SECURITY

CodeMender is a new AI-driven agent developed by Google DeepMind to discover, patch, and prevent software vulnerabilities automatically. The tool addresses threats and proactively secures existing code, enabling developers to build safer software with reduced time spent on manual vulnerability management.

deepmind.google5 min read

05MISCELLANEOUS

KLOPATRA: EXPOSING A NEW ANDROID BANKING TROJAN OPERATION WITH ROOTS IN TURKEY

Klopatra is a sophisticated new Android banking trojan operated by Turkish-speaking cybercriminals that utilizes commercial-grade Virbox protection and native code libraries to evade detection. The malware targets users in Spain and Italy through fake IPTV apps, exploits Android Accessibility Services for complete device control, and employs both overlay attacks and Hidden VNC capabilities to conduct fraudulent operations while victims are asleep. With over 3,000 compromised devices across two main botnets, Klopatra represents a significant evolution in mobile malware sophistication, demonstrating how threat actors are adopting professional-grade obfuscation techniques typically seen in desktop malware.

cleafy.com15 min read

‘YOU'LL NEVER NEED TO WORK AGAIN': CRIMINALS OFFER REPORTER MONEY TO HACK BBC

A BBC reporter was contacted via Signal by a “reach out manager” from the Medusa ransomware gang, who offered 25% of the ransom if they gained access to the reporter's corporate device. The reporter played along to gather more information about the gang's tactics, documenting increased pressure from the ransomware actor. Eventually, the actor grew impatient, sending multiple 2FA requests before the reporter could alert the BBC security team, leading to a disconnection from the network.

bbc.com3 min read

APPLE PULLS ICEBLOCK FROM THE APP STORE

The ICEBlock app described itself as “Waze but for ICE sightings” and allowed users to report sightings of ICE officials anonymously. AG Pam Bondi stated that Apple removed the app from the App Store after it was requested to be removed because it presents a threat to law enforcement officials, which ICEBlock developer Joshua Aaron has denied, stating it is patently false.

theverge.com2 min read