The Daily Index — Tuesday, April 15, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GOOGLE CHROME FIXES BROWSER HISTORY LEAKS BY PURPLE “VISITED” LINKS

Historically, bad actors have been able to track users' browsing history by utilizing the ":visited" CSS selector, which turns links purple. Google is aiming to address this leak by changing the way that the ":visited" selector is applied to only display if the user has visited the site from the current top-level site and frame origin. Effectively, the browser will now display purple links based on the combination of the current site and visited sites.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

GOVTECH GIANT CONDUENT CONFIRMS CLIENT DATA STOLEN IN JANUARY CYBERATTACK

Conduent, which provides business services to over 600 government agencies, confirmed that client data was stolen following a January cyberattack. Its investigators have discovered that the stolen data contains extensive details on its clients' end-users but have not provided additional details. Per Conduent, the data has not been posted on the dark web or elsewhere.

bleepingcomputer.com · 2 min

TLDR InfoSec

GITHUB ACTIONS AND THE PINNING PROBLEM: WHAT 100 SECURITY PROJECTS REVEAL

GitHub Actions can be silently changed, putting workflows at risk. Pinning your GitHub Actions to specific commit SHAs can help maintain consistency. Many popular security repositories do not pin all their actions, leaving them vulnerable to potential changes.

medium.com · 3 min

TLDR InfoSec

SECURITY ANALYSIS: POTENTIAL AI AGENT HIJACKING VIA MCP AND A2A PROTOCOL INSIGHTS

Communication protocols are vital for AI Agent development. Anthropic's MCP connects agents to external tools, while Google's A2A enables agent collaboration. This post dives into security vulnerabilities in these protocols that could lead to agent hijacking and data leakage.

medium.com · 1 min

TLDR InfoSec

A NOT SO COMPREHENSIVE GUIDE TO SECURING YOUR SALESFORCE ORGANIZATION

This article discusses Salesforce security vulnerabilities. Insecure SOQL queries in Apex can bypass sharing models, risking sensitive data exposure without enforcing object-level security. It warns against storing credentials in cleartext in Custom Metadata Types, Settings, Objects, and Apex comments. It also explains managed packages with namespaces, authorization, and Apex Actions via REST API, setting the stage for real-world exploitation scenarios.

netspi.com · 12 min

TLDR InfoSec

HACKTIVISM RESURGES – BUT DON'T BE FOOLED, IT'S OFTEN STATE-BACKED GOONS IN MASKS

Hacktivists targeting critical infrastructure increasingly resemble state-backed actors rather than independent activists. Groups like CyberArmyofRussia_Reborn1 and BlackJack have sophisticated capabilities and strategic timing that suggest government connections.

theregister.com · 8 min

TLDR InfoSec

THREAT MODELING GITHUB - HOW VULNERABLE-BY-DESIGN IS GITHUB?

GitHub was built around the principles of openness and collaboration to facilitate open-source development. As the platform has matured, it has become an enterprise standard, and trade-offs between openness and security have revealed its inherent security flaws. This post looks at access control, GitHub Actions and CI/CD, Secrets Management, and Repository security design issues, as well as supply chain and SHA1 collision attacks.

srajangupta.substack.com · 7 min

TLDR InfoSec

MICROSOFT STARTS FINAL WINDOWS RECALL TESTING BEFORE ROLLOUT

Microsoft has begun to roll Windows Recall out to Insiders in the Release Preview channel. Following community outrage, Microsoft initially delayed the feature, made it an opt-in feature, and required Windows Hello to access the stored screenshots. Microsoft has also stated that it has added anti-hammering and rate-limiting protections to Recall.

bleepingcomputer.com · 2 min

TLDR InfoSec

PRE-INSTALLED MALWARE ON CHEAP ANDROID PHONES STEALS CRYPTO VIA FAKE WHATSAPP

Certain low-cost Android phones may contain malware that stealthily alters cryptocurrency wallet addresses, often bundled with fake apps like WhatsApp.

hackread.com · 3 min

TLDR InfoSec

TREND MICRO FLAGS INCOMPLETE NVIDIA PATCH THAT LEAVES AI CONTAINERS EXPOSED

Nvidia's patch for the CVE-2024-0132 vulnerability in the Nvidia Container Toolkit is incomplete and could potentially expose enterprises to container escape attacks and data compromise.

securityweek.com · 2 min

TLDR InfoSec

META TO RESUME AI TRAINING ON CONTENT SHARED BY EUROPEANS

Meta will resume training its AI models using content from adult users in Europe but will not use private messages or data from Europeans under 18.

bleepingcomputer.com · 2 min