CA students data leak 🎓, Plex flaw drops miner 🎬, Grok Bot leaks bank data 🤖

An unauthorized party used a compromised login from May 22 to September 18 to copy California student files from an Educational Testing Service SFTP ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Sign Up |Advertise|View Online TLDR Together With TLDR Information Security 2026-10-20 Ransomware Risk Report Reveals AI Impact (Sponsor) AI accelerates ransomware threats and complicates defenders' jobs. Results of Semperis' annual study reveal: 84% of attacks weaponized AI. That includes: AI-driven attacks Attacks that exploited internal AI agents or systems In addition, 23% of respondents reported defensive AI tools failed to detect attacks or respond successfully. This Cybersecurity Awareness Month, explore and share the Semperis 2026 Ransomware Risk Report with your entire security team. Discover how to strengthen cyber resilience by addressing emerging AI-related risks and proactively modernizing your crisis response plans to address conventional and agentic criminal tactics. Explore key findings 🔓 Attacks & Vulnerabilities CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU (7 minute read) A crafted Cache-Control header triggers catastrophic regex backtracking in Symfony's HeaderUtils::split(). Symfony parses it on every request, before routing or authentication, and Laravel parses it three times. One request can consume up to 12.7 seconds of CPU, and four merged 8 KB headers can force timeouts. The flaw affects Symfony 4.1 through the October 2026 patches, including Laravel, Drupal, PrestaShop, and Shopware. One Compromised Login Exposed Millions of California Students' Records (3 minute read) An unauthorized party used a compromised login from May 22 to September 18 to copy California student files from an Educational Testing Service SFTP server. The data covers current and former students dating to 2006 and may include names, addresses, IDs, disability status, accommodations, and test results. The breach did not expose Social Security numbers, passwords, or financial details. ETS disabled the account, took the site offline, and is building a replacement system. 2.76M Pieces of Customers' Info at Hollys Leaked in Cyberattack (2 minute read) Korean coffee chain Hollys disclosed that it suffered a data breach impacting 2.76M pieces of personal information. The breached data includes dates of birth, phone numbers, addresses, and emails. The data was contained in temporary files provided for a past membership service overhaul. 🧠 Strategies & Tactics Web Environment Integrity vs. Private Access Tokens - They're the same thing! (5 minute read) Web Environment Integrity (WEI) and Apple's Private Access Tokens (PAT) both use signed browser or device attestations. A site can request proof that a visitor uses a genuine, non-jailbroken iPhone with Safari, then reject Firefox on Linux. WEI can additionally bind an attestation to a specific operation. The two proposals differ mainly in presentation: PAT is framed around fewer CAPTCHAs, while WEI is framed around service-provider verification. PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) (17 minute read) Researchers found a Linux networking flaw that lets an untrusted VM guest alter IPv4 header bytes after the host kernel validates them. Guest-controlled checksum metadata can change the IPv4 header length, causing the kernel to copy 32 bytes beyond the packet's logical data and transmit them as apparent IP options. In a controlled KVM lab, the disclosure supported selected 64-byte host-kernel writes and execution of a host-root helper. The upstream fix, commit 6785011f8b16, validates checksum_start before checksum completion across five IPv4 consumers. Managing Agentic Security at Scale (8 minute read) Salesforce divides vulnerabilities into strategic and tactical vulnerabilities to address the large amount of vulnerabilities that are discovered by LLMs. Strategic vulnerabilities are vulnerabilities due to a core, systemic issue where many vulnerabilities can be resolved by fixing the core issue. Tactical vulnerabilities represent exploit chains that chain together smaller severity issues for a larger impact and require exploit verification in a staging environment. 🧑‍💻 Launches & Tools The #1 rated password manager is 50% off (Sponsor) Get 50% off the password manager that actually keeps you safe from cyber threats. Keeper securely stores unique passwords for all your accounts, encrypted so only you can access them. Eliminate weak credentials, streamline access control, and reduce breach risk across your personal and work life. Beatrix Suite (GitHub Repo) A comprehensive, open-source security and automation framework designed to streamline technical workflows. It combines a robust CLI, an intuitive browser GUI, and integrated AI capabilities to deliver a flexible, modern environment for security operators and developers. Modulate (Product Launch) Modulate builds the Velma voice-analysis platform. It uses 100+ audio models to detect synthetic speech, emotion, intent, harassment, grooming, and deepfakes in real time, analyzing 10M+ hours of audio monthly. Vector (GitHub Repo) Vector is a high-performance, end-to-end (agent & aggregator) observability data pipeline that allows for the collection, transformation, and routing of logs and metrics from multiple vendors. 🎁 Miscellaneous Plex vulnerabilities being exploited in the wild to drop a cryptominer (4 minute read) A honeypot running Plex Media Server 1.43.2 observed live exploitation on October 17. Attackers chained CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to obtain remote code execution, then downloaded a cryptominer and a proxy component. The observed source IPs were 45.194.92[.]222, 91.92.40[.]202, and 176.65.139[.]228, and the payload host was 217.60.194[.]116. How a Massive Chinese Crime Ring Hacked Staples to Steal Millions (3 minute read) 404 Media reports on a Chinese threat actor that compromised Staples to issue over $5M worth of gift cards that were used to funnel goods back to Chinese addresses. The actors found a way to access Staples' Nexus service, which it believed was only exposed internally, and performed heap dumps to hijack sessions of logged-in Staples customer service representatives. The attackers used 4,630 gift cards totaling around $425K. Anthropic Quietly Pitches its Own AI Safety Bill to Lawmakers (2 minute read) Representatives from Anthropic have quietly pitched a draft AI safety bill to lawmakers. Under the bill, the government could only block a model's release or use if it poses a foreseeable, imminent risk of more than $1B in damages, or of killing or seriously injuring more than 50 people via the creation or release of a biological weapon, the model evading its developers' controls, or a cyberattack. Independent evaluators would register with the Department of Commerce and report any such risk within 72 hours. ⚡ Quick Links Seven places to stop a supply chain attack, from your lockfile to your CI pipeline (Checklist) (Sponsor) Attackers target the systems that build your software. This checklist pairs each entry point, from bad packages to GitHub Actions, with defenses to protect your build. Get the checklist → Florida DMV hacked after police dept insecurely stored login info (4 minute read) A local Florida police employee improperly stored credentials on a device, allowing attackers to breach the state's DMV on September 4 and steal driver's license data. Nikkei discloses third data breach in a month, 1.8M records exposed (2 minute read) Attackers used stolen credentials to access a Nikkei development system on October 7 and exposed 1.83 million cloud-stored records. Whoops: Grok Bot Spills Tech CEO's Bank Data In Public Slack (3 minute read) XMTP Labs CEO Shane Mac's read-only Grok Bot finance agent handed his bank balances and itemized expenses to a second Grok Bot on the same machine that had Slack access. Love TLDR? Tell your friends and get rewards! Share your referral link below with friends to get free TLDR swag! https://refer.tldr.tech/dc263000/8 Track your referrals here. Want to advertise in TLDR? 📰 If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us. Want to work at TLDR? 💼 Apply here, create your own role or send a friend's resume to jobs@tldr.tech and get $1k if we hire them! TLDR is one of Inc.'s Best Bootstrapped businesses of 2025. If you have any comments or feedback, just respond to this email! Thanks for reading, Prasanna Gautam, Eric Fernandez & Sammy Tbeile Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.