Email: Seedworm DLL Attack 🐛, Gitea Image Leak Bug 📦, Starlette ASGI Flaw 🤖

Subject:
Seedworm DLL Attack 🐛, Gitea Image Leak Bug 📦, Starlette ASGI Flaw 🤖
Received:
5/29/2026, 1:05:50 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;



&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;Iran-linked Seedworm (MuddyWater) ran an early-2026 espionage campaign that targeted nine organizations across nine countries&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/i7gomqVyFau3E5QqHV5XBPrXm-Wyw47HKLhPf42ksFw=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/QI2A24ybH83BX2debcKhpsuQbJkMb-WdrNA-tBfuXIU=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=010336f0-5b27-11f1-8245-ed6a8e23021a%26pt=campaign%26t=1780059950%26s=b86241db8d626573f539de49aa0864bd088fdee1e23fd4d23143277b40ba2e6f/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/wdMZZLczYKYP5NBcYQCGeJljmzpWtb1Do0nIcbx725U=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdiscover.picussecurity.com%2Fstart-your-free-trial%3Futm_campaign=BAS%2520Campaign%25202023%252F2024%26utm_source=tldr%26utm_medium=newsletter_header/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/CLvSq7MDqz661SUnzxT3GYZvqu2zOkHFjDa0M4nBRTM=452"&gt;&lt;img src="https://images.tldr.tech/picus.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Picus"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-05-29&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fdiscover.picussecurity.com%2Fstart-your-free-trial%3Futm_campaign=BAS%2520Campaign%25202023%252F2024%26utm_source=tldr%26utm_medium=newsletter_header/2/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/7QM4H6d3gEoTmUcQ3HONSazpKZpyrUwBwAupEAKsp30=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Double your threat prevention rate in 90 days (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Most security controls block fewer threats than teams assume. Picus customers start at 37% prevention effectiveness and reach 74% within three months by simulating 30,000+ real-world adversary actions against their actual firewall, EDR, and SIEM stack (&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhubs.li%2FQ04gMzVw0%3Futm_source=TLDR%26utm_medium=newsletter%26utm_campaign=2026-05-29_Primary_Picus%2BSecurity%26utm_content=body_it_yourself_14/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/-hbcwW4_M7xFCOV0e7b73sjnav-MtZm1_anmmTexoXs=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;try it yourself for 14 days&lt;/span&gt;&lt;/a&gt;).

&lt;p&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhubs.li%2FQ04gM5580%3Futm_source=TLDR%26utm_medium=newsletter%26utm_campaign=2026-05-29_Primary_Picus%2BSecurity%26utm_content=body_ebook/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/VtmXKg54wNT_sJXSPRUyuRpWoOco7TXDMLEEChpsr_o=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;This free eBook&lt;/span&gt;&lt;/a&gt; walks through the full process:&lt;/p&gt;

&lt;p&gt;→ &lt;strong&gt;Measure what's working:&lt;/strong&gt; See exactly what gets blocked, missed, or undetected across your prevention and detection layers.&lt;/p&gt;

&lt;p&gt;→ &lt;strong&gt;Fix gaps fast:&lt;/strong&gt; Get vendor-specific signatures and SIGMA detection rules mapped to your exact stack.&lt;/p&gt;

&lt;p&gt;→ &lt;strong&gt;Track improvement:&lt;/strong&gt; Benchmark your scores against industry peers and map ATT&amp;CK coverage over time.&lt;/p&gt;

&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhubs.li%2FQ04gM5580%3Futm_source=TLDR%26utm_medium=newsletter%26utm_campaign=2026-05-29_Primary_Picus%2BSecurity%26utm_content=cta_download_ebook/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/OVopBY_a79HOmoLaN0RippOgkqNAklQEbqZEr6IuLvY=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Download the free eBook →&lt;/span&gt;&lt;/a&gt;


&lt;/p&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fcybersecuritynews.com%2Fseedworm-apt-abuses-signed-fortemedia-2%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/GZXBvT7SEeDCpv70Y_u-tI0DsslfwLji9vLsFRsu0XI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Iran-linked Seedworm (MuddyWater) ran an early-2026 espionage campaign that targeted nine organizations across nine countries, abusing legitimate Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) binaries to sideload malicious DLLs containing the ChromElevator browser-data stealer. The operators orchestrated the chain via node.exe rather than PowerShell to evade detection, established registry-key persistence, deployed credential theft tools in redundant waves, and exfiltrated data via the public file-transfer service sendit[.]sh to blend into normal cloud traffic. Defenders should monitor for unsigned DLLs loaded alongside signed executables, flag unexpected Node.js activity, block outbound traffic to unknown file-transfer services, and enforce strict startup registry policies.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.techtimes.com%2Farticles%2F317291%2F20260527%2Fgitea-flaw-left-30000-deployments-private-container-images-readable-4-years.htm%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/FcxSyV3_TLXlh73fOnAclu206mfnABu_qH-PepAxMvI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Gitea Flaw Left 30,000 Deployments' Private Container Images Readable for 4 Years (8 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A Gitea container registry bug (CVE-2026-27771) allowed unauthenticated users to pull “private” images for about four years, exposing code, secrets, and production wiring across roughly 30,000 self-hosted Gitea and Forgejo instances in sectors such as healthcare, aerospace, SaaS, and ISPs. Operators should upgrade to Gitea v1.26.2, consider setting REQUIRE_SIGNIN_VIEW=true as a stopgap, and audit registry logs for suspicious pulls.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftechcrunch.com%2F2026%2F05%2F28%2Fa-security-lapse-at-prison-payphone-service-pay-tel-publicly-exposed-over-300000-callers-drivers-licenses%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/JuN84-mrGjCcPvLo5jSKxbyZlCznDDUrJMbZb9XYGwY=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;A security lapse at prison pay phone service Pay Tel publicly exposed over 300K callers' driver's licenses (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Pay Tel left an Azure storage server open on the internet with at least 300,000 scanned driver's licenses, other ID documents, user photos, and inmate communications, including texts, handwritten notes, and financial records. UpGuard reported the exposed bucket on May 7, and Pay Tel later locked it down but has not acknowledged the incident or said if it will notify affected users.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhackread.com%2Firan-nimbus-manticore-trojan-zoom-installers-us-firms%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/FlRLUqNUlZqaxjS0rh3ekgJ4VkHR1VTjqc0mt14WdQ8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Iran's Nimbus Manticore Used Trojanized Zoom Installers Against US Firms (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    IRGC-linked Nimbus Manticore (UNC1549) ran a campaign from February to April that paired AppDomain hijacking, where a malicious Setup.exe.config sits beside a signed Microsoft Setup.exe, with trojanized Zoom installers (Zoom_cm.exe) to deploy the MiniJunk and MiniFast backdoors while hijacking the legitimate ZoomUpdateTaskUser scheduled task for persistence. The group escalated tradecraft mid-conflict, building AI-assisted code that gave full cmd.exe remote control over Chrome-impersonating traffic, then abandoned email lures for SEO poisoning that pushed a fake getsqldeveloper[.]com to the top of Bing and DuckDuckGo. Defenders should hunt for .config files paired with signed binaries, audit scheduled tasks for tampering, and watch for download activity from typosquatted software-download domains.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fnovee.security%2Fblog%2Fpretalx-stored-xss-vulnerability-account-takeover%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/hw0fCKEF7n7eacYmPqawXD2hCVX0aVsTh7-RMQpUD9I=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;How to Get a 100% Conference Acceptance Rate, The Novee Way: A High-Severity CVE in Leading Call-for-Papers Software (6 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Novee researchers found a stored XSS in pretalx that lets any registered user inject HTML or JavaScript into organizer search results and execute code in the organizer's browser on a matching query. The exploit uses an iframe srcdoc to bypass innerHTML script blocking and a same-origin uploaded .js file to satisfy CSP, then hijacks the organizer session and can permanently revoke superuser rights via authenticated GETs. An attacker can automate submissions, plant payloads in titles, and drive near-certain exploitation across many conferences using shared pretalx deployments.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Foblique.security%2Fblog%2Fpolicy-rollout%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/7Q7J9o70U9pkK6WoJ9fp5If_CiuFYGbNzJ9GYOiifA8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;The Security Policy Rollout Survival Guide (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    When rolling out new security policies, teams should begin by communicating the details of the change, when it is going into effect, and why it is being made. Before rolling out the change, teams should run a pilot with a diverse set of users and iterate upon feedback from the pilot. Finally, when rolling out the policy teams should make enforcement of the policy visible, be in charge of enforcing it, and prepare for exceptions.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fpuck-security%2Fpuck-oss%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/KoC89AIe4oUO7fWnfSDoxDvQTZd2nIbNvrrBYkB8r74=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Puck (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Puck is an MIT-licensed MCP server that drives autonomous, read-only endpoint investigations across a fleet, letting an engineer ask plain-English questions through Claude Code or any MCP client and receive narrative findings with containment recommendations. Rust agents execute only commands from a compiled-in typed allowlist enforced independently by both the Go server and the agent, so the worst case of a compromise is unauthorized read access rather than modification, with mTLS enrollment, audit logging, and cost caps built in. Operators should note that puck-agent reads sensitive files like keychains and process memory and may trip EDR heuristics, so it should be allowlisted before enrollment, and investigations should run under an API key or Teams/Enterprise plan rather than a training-enabled consumer account.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.ibm.com%2Fproducts%2Flightwell%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/or0siIu2BcDLybvEPFVNZx5S7b1EC8Ka_xZEK61b7_E=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Project Lightwell (4 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    IBM and Red Hat launched Project Lightwell with a $5 billion commitment to secure open source supply chains. The system backports vulnerability fixes to exact dependency versions already in production using 20,000 engineers and AI to patch packages across Maven/Java, with PyPI, npm, and Go planned. It works through dependency manifests like pom.xml without accessing source code, delivering signed patches with SLAs to repositories you control.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Flatiotech%2FLAST%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/KdncP-RemSIV0nJ7T4mhYARW023jQKizePZlsIEmtCU=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;LAST (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Use AI to Scan Your Code from the Command Line for security and code smells. Bring your own keys. Supports OpenAI and Gemini.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F4UD2AB/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/x-nz1yB4splibM4M48l-v7Wi1CTNI68K2612LZ1DqJo=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Glassworm botnet disrupted after resilient C2 infrastructure takedown (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    CrowdStrike, Google, and The Shadowserver Foundation have disrupted the developer-targeting Glassworm botnet, active since October 2025 through malicious OpenVSX and VS Code extensions, GitHub repos, and npm packages that stole crypto wallets and developer credentials, by simultaneously severing four deliberately resilient C2 channels: Solana blockchain memo fields, the BitTorrent DHT, Google Calendar event titles holding Base64-encoded paths, and direct VPS connections. Any single channel could fail over to the others, so the operators built indirection layers that only a coordinated, all-at-once takedown could defeat, after which infected hosts can no longer pull new instructions or payloads. Defenders should hunt for compromised machines now beaconing to the CrowdStrike-operated sinkhole at 164.92.88[.]210 and apply the published YARA rules to confirm infections, then remediate the malicious extensions and packages on affected developer endpoints.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.lastweekinaws.com%2Fblog%2Freading-observability-tools-thats-a-robots-job%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/8bUP58K6orHgotC2PiyYcZSLKp7LaIyjDzgrwiznnjI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Reading Observability Tools? That's a Robot's Job (5 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Metrics, logs, and traces have long been the three pillars that were touted for observability tooling. These pillars don't hold up in the era of LLMs and agentic systems because they were designed for humans even though agents are now the primary consumers of observability. Traces are the primary pillar now and their schema should be versioned and viewed similarly to an API.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Farstechnica.com%2Finformation-technology%2F2026%2F05%2Fmillions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package%2F%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/qDSFvG3Anm4yA7wdjqiTiBBvcTEM29zxlY8ovyS3KY0=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Millions of AI Agents Imperiled by Critical Vulnerability in Open Source Package (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A critical vulnerability was discovered in the Startlette ASGI implementation that underpins FastAPI and other widely used frameworks for building Python services. The vulnerability can be trivially exploited to bypass path-based authorization by adding a single character to the HTTP host header. Developers relying on projects that use Startlette, such as FastLLM, vLLM, or LiteLLM, should make sure to update.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2026%2F05%2Fscammers-pretending-to-be-microsoft-had-help-from-us-executives%3Futm_source=tldrinfosec/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/CI3loeofhY6piM46RRE-QEStDvFrZPsdIS3yHruqknw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Scammers pretending to be Microsoft had help from US executives (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    The US DoJ has secured guilty pleas from C.A. Cloud Attribution former CEO Adam Young and former CSO Harrison Gevirtz.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FaRYKR8/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/xlNgqhEsggfE5JrJ83-BIzzHwKKkYfl2sO6AqfVOY9I=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;California amendment would exempt Linux from age verification law (1 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A proposed California amendment redefines "operating system provider" to exclude open-source, user-modifiable software.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FHN6bld/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/kht9QlOwUmYHc2Dc5ApSZCXC_2XEuTGZ0mL3gnczxvw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Carnival Data Breach Exposed 6 Million People (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Hackers used social engineering to compromise a Carnival employee account on April 14, then accessed internal systems and exfiltrated files with personal data for about 5,995,277 people.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/c7Jeg0gBhB3mUE2FT9c8RM1FaA0AYyTQwLvMaJ0i2lE=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/DvXPv83ySKPHgY4ZDAEh8sGPl1-emVL0L3OZ0pSX4dw=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/zioR_2ObT9eK5dALCH8HKezdLKesHT8ITAspc4jKabg=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/SfRLWMnyTG6Jezbvg75d2aOtdSL6T_utGMVJoM-S8x0=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/4ecnVqKEbqnxUzlkb5yicqd_Y4tiw5YKdPbnl_Bw5OA=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/V1OpnMByzWry7fD6p4yNys4jcH6-IsggjJez84sYVjo=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/Qfa6NUIbHTG7X1MxQrrNReIxgkzUXN4tL-KGzvPJLm4=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/T6QKEmLnOtAs7xnINfpcaZnYJGFlimAiXKUw86kxKag=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/JQGJ1kvAM8enSbdMr8qfPkMudNwoMZLd7M-yhb5JmFU=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/v91LMWDfoDugDcEGQ0mpPujkXmCkEWtUk-EXAF3o7oM=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=010336f0-5b27-11f1-8245-ed6a8e23021a%26pt=campaign%26pv=4%26spa=1780059640%26t=1780059950%26s=8fc95cb0a4a85010d590d37983ea9b324ad39ca9e9fe44f166d106ed5d533509/1/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/ItTMkWshXMXgI0Ys0tErpmGVg9bYvPwSS9oSsfpnEhE=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/0100019e73d74dda-bcefe586-3e96-4e14-a7d5-dbb6cc721f59-000000/iyZkNkSbWuK5GqBL2s8WyvqvJt89V0LenAI7glO5aLI=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
