Attacks & Vulnerabilities
|
Grafana releases critical security update for Image Renderer plugin (2 minute read)
Grafana Labs has issued security updates for its Image Renderer plugin and Synthetic Monitoring Agent to fix four high-severity Chromium vulnerabilities (CVE-2025-5959, CVE-2025-6554, CVE-2025-6191, and CVE-2025-6192). These flaws could allow remote code execution, memory access, and heap corruption via crafted HTML pages. Affected versions are those prior to 3.12.9 for Image Renderer and 0.38.3 for Monitoring Agent, both of which include a headless Chromium browser for dashboard rendering. Users should update immediately. Cloud and Azure instances have already been patched.
|
|
Guest Post: How I Scanned all of GitHub's “Oops Commits” for Leaked Secrets (12 minute read)
A security researcher discovered that GitHub permanently stores "deleted" commits from force pushes as "zero-commit" PushEvents in the GitHub Archive, making supposedly removed secrets still accessible via commit hashes. By scanning all zero-commit force push events since 2020 using the GitHub Event API and GitHub Archive data, the researcher built automated tools to identify and analyze these hidden commits for leaked credentials, uncovering $ 25,000 worth of active secrets. Key security strategies include implementing pre-commit secret scanning, treating any committed secret as permanently compromised regardless of deletion attempts, immediately revoking exposed credentials, and protecting .env files, which were the most common source of leaked secrets.
|
Reverse Engineering Cursor's LLM Client (6 minute read)
In this post, the authors used TensorZero, an open-source framework for optimizing LLM applications with downstream feedback signals, to observe the API calls and tokens sent between Cursor and the LLM providers. They first ran into errors connecting to TensorZero running locally because Cursor first sends a request to Cursor's servers for additional processing, so the authors needed to set up a reverse proxy to expose a public endpoint that would forward requests back to the local machine. They then had to solve for CORS issues. Eventually, they managed to wire Cursor up properly and included sample system prompts and interactions between a user session and what Cursor generates.
|
|
ShadowCrypt (GitHub Repo)
Proactive ransomware defense and secure file hiding for Windows. Effortlessly protect, access, and recover sensitive files using encrypted mappings and smart shortcuts.
|
Secrets Ninja (GitHub Repo)
Secrets Ninja is a GUI-based tool that validates API keys and credentials found during penetration testing. It tests these secrets directly from your browser using frontend JavaScript, ensuring that no sensitive information is ever collected or logged.
|
TrollRPC (GitHub Repo)
TrollRPC is a library to bind RPC calls based on UUID and OPNUM. The goal of the library is to break specific RPC calls to an antivirus scanner for AMSI bypass.
|
|
Ransomware gang Hunters International says it's shutting down (3 minute read)
The Hunters International ransomware gang announced its shutdown on Thursday, offering free decryption keys to its victims. The group operated for two years, targeting organizations including a U.S. cancer center. Security experts suspect that this may be a rebranding effort, with the gang potentially transitioning to "World Leaks" to evade detection by law enforcement.
|
Uncovering Nytheon AI - A New Platform of Uncensored LLMs (7 minute read)
Threat researchers at Cato CTRL have released a report on an uncensored LLM platform known as Nytheon AI. The operators behind Nytheon trained a suite of gen AI tools by employing jailbreaks on open-source models from Meta and Deepseek. The Nytheon AI suite includes models for code generation, document summarization and translation, OCR, and a control model.
|
|
|
Love TLDR? Tell your friends and get rewards!
|
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
|
Track your referrals here.
|
|
Want to advertise in TLDR? 📰
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us.
Want to work at TLDR? 💼
Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them!
If you have any comments or feedback, just respond to this email!
Thanks for reading,
Prasanna Gautam, Eric Fernandez & Sammy Tbeile
|
|
|
|