TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-12-18

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

MALWARE

Most endpoint vendors expect you to trust their marketing. Arctic Wolf hands you real malware and says "go ahead."

cybersecurity.arcticwolf.comSponsor

02ATTACKS & VULNERABILITIES

ARCTIC WOLF OBSERVES MALICIOUS SSO LOGINS ON FORTIGATE DEVICES FOLLOWING DISCLOSURE OF CVE-2025-59718 AND CVE-2025-59719

Arctic Wolf observed active exploitation of critical Fortinet authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) starting December 12, just three days after Fortinet's disclosure. Attackers used crafted SAML messages to gain unauthenticated admin access to FortiGate devices with FortiCloud SSO enabled. Threat actors logged in via SSO from hosting provider IPs and immediately exfiltrated device configurations containing hashed credentials via the GUI. Organizations should promptly upgrade affected versions of FortiOS, FortiProxy, FortiWeb, and FortiSwitchManager, disable FortiCloud SSO as a workaround, reset all firewall credentials if compromise indicators are observed, and restrict management interface access to trusted internal networks.

arcticwolf.com9 min read

AUTO PARTS GIANT LKQ CONFIRMS ORACLE EBS BREACH

Automotive parts supplier LKQ has confirmed it was hit in the Oracle E-Business Suite hacking campaign linked to the Cl0p ransomware group, exposing personal data, including SSNs and EINs, of over 9,000 sole proprietor suppliers. The company says the incident is limited to its Oracle EBS environment, though several terabytes of data were stolen, and notes it previously suffered a separate cyberattack affecting a Canadian business unit.

securityweek.com3 min read

WHATSAPP DEVICE LINKING ABUSED IN ACCOUNT HIJACKING ATTACKS

Gen Digital researchers have uncovered a new phishing campaign, which they dubbed GhostPairing, that abuses the device-linking feature of WhatsApp to hijack accounts. The victims are contacted by a known contact that shares a link allegedly leading to an online photo of a victim, which leads to a fake Facebook site that requests the user to initiate a device-linking process to log in. Attackers can then use the victim's account to forward the initial lure and propagate.

bleepingcomputer.com2 min read

03STRATEGIES & TACTICS

WE SHOULD ALL BE USING DEPENDENCY COOLDOWNS

Analysis of recent supply chain attacks, including xz-utils, Ultralytics, tj-actions, and web3.js, revealed that most exploitation windows last only hours to days before detection and remediation. 8 out of 10 examined attacks had windows under one week. Implementing a 7-14 day dependency cooldown via Dependabot or Renovate would have prevented 80-90% of these attacks by simply waiting for compromised packages to be identified and removed before adoption. The technique is free, easy to configure, and among the most effective mitigations against mass-impact supply chain compromises.

blog.yossarian.net4 min read

DETECTING MALICIOUS PULL REQUESTS AT SCALE WITH LLMS

Datadog's BewAIre is an LLM-powered system that reviews every pull request for malicious intent. Achieving over 99.3% accuracy and a 0.03% false positive rate after six months of tuning, the system addresses limitations of traditional static analysis by detecting intent-based attacks, such as credential exfiltration and obfuscated payloads, and by using recursive diff chunking to handle large PRs that attackers exploit to hide malicious code. Security teams can apply similar approaches by combining curated malicious datasets, prompt engineering with pattern exclusions, and adversarial red-teaming to build LLM-based detection that complements existing SAST/SCA tooling.

datadoghq.com13 min read

AUTHORIZING ACCESS TO DATA WITH RAG IMPLEMENTATIONS

Retrieval-Augmented Generation (RAG) is commonly used by organizations to augment an LLM's knowledge base with additional information, such as internal documentation. RAG poses authorization risks as the LLM performs the search, so any authorization checks at the data source are skipped. This tutorial shows how to use S3 Access Grants with Amazon Bedrock Knowledge Bases to add authorization checks to the RAG flow.

aws.amazon.com6 min read

04LAUNCHES & TOOLS

OWASP SOCIAL OSINT AGENT

OWASP Social OSINT Agent is an agent designed for OSINT investigations that leverages both text and vision-capable LLMs via any OpenAI-compatible API to gather, analyze, and synthesize user activity across single or multiple social media accounts.

github.comGitHub repository

DUX (PRODUCT LAUNCH)

Dux is an agentic exposure management startup that uses AI workers to analyze enterprise environments, identify exploitable attack paths, validate existing controls, and recommend lightweight mitigations to prevent vulnerability exploitation across assets.

dux.io

YAKLANG

YAK is a large-scale cybersecurity technology stack built around a domain-specific language. It spans compiler technology, security infrastructure, vulnerability analysis, and many other areas.

github.comGitHub repository

05MISCELLANEOUS

MOST PARKED DOMAINS NOW SERVING MALICIOUS CONTENT

Infoblox research shows over 90% of parked domains now redirect visitors to scams, malware, or infostealers, up from less than 5% a decade ago. Malicious redirects target residential IPs, while VPN users see safe parking pages. One threat actor controls nearly 3,000 typosquatting domains targeting major sites such as Gmail, YouTube, Netflix, and government sites, hosting a mail server to capture misaddressed emails for business email attacks. Users should use bookmarks instead of typing to avoid typosquatting.

krebsonsecurity.com6 min read

THE 2025 CLOUDFLARE RADAR YEAR IN REVIEW: THE RISE OF AI, POST-QUANTUM, AND RECORD-BREAKING DDOS ATTACKS

Cloudflare recorded unprecedented DDoS attacks in 2025, with hyper-volumetric assaults reaching 31.4 Tbps and 14 Bpps. During this period, global Internet traffic increased by 19%, and AI crawler activity surged, with Googlebot accounting for 4.5% of HTML requests and user action crawling rising over 15 times. Adoption of post-quantum encryption nearly doubled, covering 52% of human-generated web traffic. An email security analysis revealed 5.6% of messages as malicious, mainly due to deceptive links. 174 major Internet outages were documented, with nearly half caused by government-enforced shutdowns. Security professionals should closely watch the expanding capacity for hyper-volumetric DDoS attacks, adopt post-quantum cryptography as it becomes widely used, and enhance email security measures against sophisticated impersonation and brand deception attacks enabled by AI-generated content.

blog.cloudflare.com47 min read

MICROSOFT SECURITY UPDATES BREAKS MSMQ ON OLDER WIN SYSTEMS

Microsoft acknowledges that December 2025 security updates have broken Microsoft Message Queuing on some older Windows 10 and Windows Server systems, causing inactive queues. The root cause is tightened NTFS permissions on the MSMQ storage folder, which now block required write access for MSMQ users. Only older, mostly enterprise systems are affected. There is no proper fix beyond workarounds or uninstalling the update.

theregister.com3 min read