Beacon CRM Full Database Theft 🥷, OWASP CI/CD Top 10 🚀, Windows 11 Drops WMIC 🪟

Beacon CRM confirmed an attacker used an AWS access key exposed in public JavaScript. Cost data showed transfers matching all stored records ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Sign Up |Advertise|View Online TLDR Together With TLDR Information Security 2026-08-18 Gartner: Orgs that prioritize CTEM are 3x less likely to suffer a breach (Sponsor) You have more visibility than ever. Is your risk actually lower? Instead of chasing vulnerability noise, security teams want to verify real attack paths so they know what they do matters. This Horizon3 webinar lays out how to do that by operationalizing CTEM.  📊 Join for the people, process, and metrics changes that you need to put CTEM principles into practice. 🥷 Take the attacker's perspective to pivot from static CVE lists to demonstrating meaningful risk reduction. 👉 If you feel like you're getting too much visibility without reducing risk, this is for you.  See how to reduce your exposure with CTEM 🔓 Attacks & Vulnerabilities Beacon CRM Confirms Full Database Theft After AWS Access Key Breach (2 minute read) Beacon CRM confirmed an attacker used an AWS access key exposed in public JavaScript. Cost data showed transfers matching all stored records and attachments. With valid credentials, the attackers were able to decrypt protected data during download. Beacon rotated keys, removed client-side secrets, and added endpoint and cloud monitoring. Sogang University Hit By Personal Information Breach of 180,000 (2 minute read) South Korea's Sogang University disclosed a data breach affecting 180k students, alumni, and employees. The compromised information includes student identification numbers, names, affiliations, email addresses, mobile phone numbers, and encrypted passwords for the university's integrated login system. Wallet Provider SafePal Says Data Breach Exposed Personal Info of Nearly 40,000 Customers (2 minute read) This past weekend, crypto wallet provider SafePal announced that an authorization flaw in its order tracking system allowed unauthorized access to personal data belonging to nearly 40k customers. The breached data includes customer names, email and shipping addresses, phone numbers, and purchase details, but did not involve any wallet credentials, financial details, or government IDs. 🧠 Strategies & Tactics CSS: The Bomb Inside Your Inbox (20 minute read) Portswigger demonstrates CSS and HTML attacks against webmail sanitizers. Outlook labels can trigger interface actions, while a CSS parser flaw enables arbitrary CSS injection and a spoofed login screen that captures passwords in Firefox. Yahoo Mail and AOL Mail allowed pasted CSS to race sanitization, exposing Medium email-login tokens. Fastmail image-proxy flaws enabled view tracking, ProtonMail could reveal an IP address, and hidden prompt instructions in email content directing Atlas browser actions. The recommended security controls include sandboxed iframes, restrictive allowlists, blocked image requests, and filtering dangerous selectors. OWASP Top 10 CI/CD Security Risks (5 minute read) The OWASP Top 10 CI/CD Security Risks initiative provides a framework to help defenders identify and secure vulnerabilities within continuous integration and delivery environments. The list catalogs critical risks including dependency-chain abuse, poisoned pipeline execution, inadequate access controls, credential hygiene issues, artifact integrity gaps, insecure configurations, and insufficient logging. The project provides recommended security controls and references to help organizations mitigate identified CI/CD risks. Attacking SAM and Extracting Hashes With 7z (4 minute read) 7z is an archiving and unarchiving tool that is incredibly popular on Windows systems. Users can extract hives by typing \\.\ in the 7z address bar and then navigating to PhysicalDrive0 followed by 0.ntfs to locate the system hives which can be extracted to a separate system and then cracked. This technique requires GUI access as 7z can only parse physical disks and NTFS partitions through the File Manager GUI. 🧑‍💻 Launches & Tools Modernize application and API security (Sponsor) Watch this on-demand webinar from AWS and SANS Institute to explore how APIs, cloud-native development, and agentic AI reshape security risks. Learn strategies to evolve threat models, strengthen governance, and adapt controls. Watch now and explore AWS Partner solutions in AWS Marketplace. Nullock (GitHub Repo) Nullock is a free, self-hosted alternative to Burp Suite Pro that contains an MITM proxy with a full active scanner (SQLi/XSS/SSRF/XXE/SSTI/smuggling), recon, OAST, nuclei-style templates, and a CI security gate. deadair (GitHub Repo) deadair is an open-source tool that audits live SIEM rule inventories to identify active detections that are failing silently due to missing, stale, or schema-incompatible telemetry. By utilizing read-only metadata credentials, the tool resolves rule inputs against backend semantics to verify index resolution, document freshness, and ingest lag across Elastic Security and OpenSearch Security Analytics environments. Security engineering teams can deploy deadair to generate fleet-wide coverage reports or to automatically gate candidate detection rules within their CI pipelines. Fibratus (GitHub Repo) Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner. 🎁 Miscellaneous Mozilla Revokes Firefox Signing Key After Unencrypted Copy Lands in GitHub (2 minute read) Mozilla revoked and replaced a GPG private subkey after an unencrypted copy of it was pushed to a private GitHub repository. The key signed Firefox and Thunderbird Linux tarballs, RPM packages, and checksums. Mozilla found no unauthorized access in the available audit records, but manual signature verifiers must import the new key and revoke the old key. Trivy, Not LiteLLM Behind the 2,500 Org Compromise (3 minute read) SOCRadar tied 2,085 of 2,188 tracked data exposures to the earlier Trivy compromise. Data collection ran from March 19 to March 24 and showed that malicious LiteLLM packages appeared only for 40 minutes on March 24. The worm stole tokens, keys, and credentials from CI/CD systems, then used developer secrets to poison more packages. Stolen datasets are now being sold on Telegram. ⚡ Quick Links LoongLeak (3 minute read) LoongLeak affects Loongson 3A5000 and 3A6000 processors. Windows 11 is Fully Removing a Legacy Tool that Malware and Ransomware Have Abused for Years (3 minute read) Microsoft will be removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 systems starting in 24H2, 25H2, and 26H2. Love TLDR? Tell your friends and get rewards! Share your referral link below with friends to get free TLDR swag! https://refer.tldr.tech/dc263000/8 Track your referrals here. Want to advertise in TLDR? 📰 If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us. Want to work at TLDR? 💼 Apply here, create your own role or send a friend's resume to jobs@tldr.tech and get $1k if we hire them! TLDR is one of Inc.'s Best Bootstrapped businesses of 2025. If you have any comments or feedback, just respond to this email! Thanks for reading, Prasanna Gautam, Eric Fernandez & Sammy Tbeile Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.