TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-08-18

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

GARTNER: ORGS THAT PRIORITIZE CTEM ARE 3X LESS LIKELY TO SUFFER A BREACH

You have more visibility than ever. Is your risk actually lower? Instead of chasing vulnerability noise, security teams want to verify real attack paths so they know what they do matters. This Horizon3 webinar [5] lays out how to do that by operationalizing CTEM. 馃搳 Join for the people, process, and metrics changes that you need to put CTEM principles into practice. 馃シ Take the attacker's perspective [6] to pivot from static CVE lists to demonstrating meaningful risk reduction. 馃憠 If you feel like you're getting too much visibility without reducing risk, this is for you.

events.horizon3.aiSponsor

02ATTACKS & VULNERABILITIES

BEACON CRM CONFIRMS FULL DATABASE THEFT AFTER AWS ACCESS KEY BREACH

Beacon CRM confirmed an attacker used an AWS access key exposed in public JavaScript. Cost data showed transfers matching all stored records and attachments. With valid credentials, the attackers were able to decrypt protected data during download. Beacon rotated keys, removed client-side secrets, and added endpoint and cloud monitoring.

cybersecuritynews.com2 min read

SOGANG UNIVERSITY HIT BY PERSONAL INFORMATION BREACH OF 180,000

South Korea's Sogang University disclosed a data breach affecting 180k students, alumni, and employees. The compromised information includes student identification numbers, names, affiliations, email addresses, mobile phone numbers, and encrypted passwords for the university's integrated login system.

koreaherald.com2 min read

WALLET PROVIDER SAFEPAL SAYS DATA BREACH EXPOSED PERSONAL INFO OF NEARLY 40,000 CUSTOMERS

This past weekend, crypto wallet provider SafePal announced that an authorization flaw in its order tracking system allowed unauthorized access to personal data belonging to nearly 40k customers. The breached data includes customer names, email and shipping addresses, phone numbers, and purchase details, but did not involve any wallet credentials, financial details, or government IDs.

links.tldrnewsletter.com2 min read

03STRATEGIES & TACTICS

CSS: THE BOMB INSIDE YOUR INBOX

Portswigger demonstrates CSS and HTML attacks against webmail sanitizers. Outlook labels can trigger interface actions, while a CSS parser flaw enables arbitrary CSS injection and a spoofed login screen that captures passwords in Firefox. Yahoo Mail and AOL Mail allowed pasted CSS to race sanitization, exposing Medium email-login tokens. Fastmail image-proxy flaws enabled view tracking, ProtonMail could reveal an IP address, and hidden prompt instructions in email content directing Atlas browser actions. The recommended security controls include sandboxed iframes, restrictive allowlists, blocked image requests, and filtering dangerous selectors.

portswigger.net20 min read

OWASP TOP 10 CI/CD SECURITY RISKS

The OWASP Top 10 CI/CD Security Risks initiative provides a framework to help defenders identify and secure vulnerabilities within continuous integration and delivery environments. The list catalogs critical risks including dependency-chain abuse, poisoned pipeline execution, inadequate access controls, credential hygiene issues, artifact integrity gaps, insecure configurations, and insufficient logging. The project provides recommended security controls and references to help organizations mitigate identified CI/CD risks.

owasp.org5 min read

ATTACKING SAM AND EXTRACTING HASHES WITH 7Z

7z is an archiving and unarchiving tool that is incredibly popular on Windows systems. Users can extract hives by typing \\.\ in the 7z address bar and then navigating to PhysicalDrive0 followed by 0.ntfs to locate the system hives which can be extracted to a separate system and then cracked. This technique requires GUI access as 7z can only parse physical disks and NTFS partitions through the File Manager GUI.

hackers-arise.com4 min read

04LAUNCHES & TOOLS

Sponsored

MODERNIZE APPLICATION AND API SECURITY

Watch this on-demand webinar [15] from AWS and SANS Institute to explore how APIs, cloud-native development, and agentic AI reshape security risks. Learn strategies to evolve threat models, strengthen governance, and adapt controls. Watch now and explore AWS Partner

pages.awscloud.comSponsor

NULLOCK

Nullock is a free, self-hosted alternative to Burp Suite Pro that contains an MITM proxy with a full active scanner (SQLi/XSS/SSRF/XXE/SSTI/smuggling), recon, OAST, nuclei-style templates, and a CI security gate.

github.comGitHub repository

DEADAIR

deadair is an open-source tool that audits live SIEM rule inventories to identify active detections that are failing silently due to missing, stale, or schema-incompatible telemetry. By utilizing read-only metadata credentials, the tool resolves rule inputs against backend semantics to verify index resolution, document freshness, and ingest lag across Elastic Security and OpenSearch Security Analytics environments. Security engineering teams can deploy deadair to generate fleet-wide coverage reports or to automatically gate candidate detection rules within their CI pipelines.

github.comGitHub repository

FIBRATUS

Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner.

github.comGitHub repository

05MISCELLANEOUS

MOZILLA REVOKES FIREFOX SIGNING KEY AFTER UNENCRYPTED COPY LANDS IN GITHUB

Mozilla revoked and replaced a GPG private subkey after an unencrypted copy of it was pushed to a private GitHub repository. The key signed Firefox and Thunderbird Linux tarballs, RPM packages, and checksums. Mozilla found no unauthorized access in the available audit records, but manual signature verifiers must import the new key and revoke the old key.

theregister.com2 min read

TRIVY, NOT LITELLM BEHIND THE 2,500 ORG COMPROMISE

SOCRadar tied 2,085 of 2,188 tracked data exposures to the earlier Trivy compromise. Data collection ran from March 19 to March 24 and showed that malicious LiteLLM packages appeared only for 40 minutes on March 24. The worm stole tokens, keys, and credentials from CI/CD systems, then used developer secrets to poison more packages. Stolen datasets are now being sold on Telegram.

links.tldrnewsletter.com3 min read