TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 12 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 9 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR ProductTLDR Product · 10 stories
  8. Page 8: TLDR DesignTLDR Design · 12 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design · 11 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Product · 6 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

EDUCATION GIANT PEARSON HIT BY CYBERATTACK EXPOSING CUSTOMER DATA

Pearson has reported that an attacker breached its systems and stole “legacy” data. Other sources revealed that the stolen data was obtained via an exposed .git/config file containing a GitLab Personal Access Token (PAT), which was used to obtain hardcoded secrets for cloud platforms and data stores from source code. The stolen data allegedly contains customer information, financials, support tickets, and source code.

bleepingcomputer.com · 2 min

TLDR InfoSec

CISCO FIXES MAX SEVERITY IOS XE FLAW LETTING ATTACKERS HIJACK DEVICES

Cisco has released fixes for a maximum severity (10.0 CVSS score) vulnerability affecting IOS XE Software for Wireless LAN Controllers. The devices utilize a hardcoded JWT that could allow unauthenticated attackers to exploit the AP image download interface to upload files, perform path traversal, or execute arbitrary code. Only devices with the “Out-of-Band AP Image Download” feature, which allows APs to download AP's OS images via HTTPS, are vulnerable.

bleepingcomputer.com · 2 min

TLDR InfoSec

PHISHING DESPITE FIDO, LEVERAGING A NOVEL TECHNIQUE BASED ON THE DEVICE CODE FLOW

Enforcing FIDO as the sole MFA is often seen as phishing resistant. However, this post shows a new attack that utilizes the OAuth 2.0 Device Code Flow to downgrade MFA. The Device Code Flow enables a user to authenticate devices. In this method, an attacker uses a headless browser to automate the Device Code Flow, allowing the user to be phished through an attacker-controlled link without entering the code.

denniskniep.github.io · 6 min

TLDR InfoSec

DOGE BRO KYLE SCHUTT'S COMPUTER INFECTED BY MALWARE, CREDENTIALS FOUND IN STEALER LOGS

Micah Lee searched for DOGE employee Kyle Schutt's personal Gmail address on Have I Been Pwned and found that he appeared in 51 breaches and five pastes. Notably, Schutt's credentials appeared in info-stealer logs, meaning that a device belonging to him was infected with info-stealer malware at some point. Schutt has access to FEMA's core financial systems. DOGE has not confirmed if employees are using work or personal devices.

micahflee.com · 3 min

TLDR InfoSec

DRAG AND PWND: LEVERAGE ASCII CHARACTERS TO EXPLOIT VS CODE

Zakhar Fedotkin found that ASCII control characters such as SOH (\x01) and ETX (\x03) can be exploited in Visual Studio Code to run arbitrary commands via node-pty, which sends raw bytes to the shell. The vulnerability exploits two vectors: injecting control characters into run configuration files and creating maliciously named files that execute commands when dragged into VS Code's terminal. This issue impacts macOS and Ubuntu systems, where control characters are permitted in filenames, although Microsoft does not view it as a security vulnerability due to measures like workspace trust warnings.

portswigger.net · 4 min

TLDR IndexPage 5