The Daily Index — Thursday, June 5, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MALICIOUS RUBYGEMS POSE AS FASTLANE TO STEAL TELEGRAM API DATA

Researchers at Socket identified two malicious Ruby gems impersonating the fastlane-plugin-telegram gem, which is used for sending CI/CD updates from Fastlane to a Telegram channel. The typosquatted gems are nearly identical to the legitimate gem except that they redirect Telegram API calls to an attacker-controlled server. Any bot tokens that were used in builds with the malicious gems should be considered compromised.

bleepingcomputer.com · 2 min

TLDR InfoSec

35K SOLAR POWER SYSTEMS EXPOSED TO THE INTERNET

Cybersecurity researchers at Forescout have discovered that roughly 35k solar power systems are internet exposed. These devices were found by searching on Shodan and many are vulnerable to existing exploits.

securityweek.com · 2 min

TLDR InfoSec

HOW I USED O3 TO FIND CVE-2025-37899, A REMOTE ZERO-DAY VULNERABILITY IN THE LINUX KERNEL'S SMB IMPLEMENTATION

A security researcher used OpenAI's o3 model to find CVE-2025-37899, a previously unknown zero-day use-after-free vulnerability in the Linux kernel's SMB implementation (ksmbd). The flaw occurs when one thread frees a session user object while another thread on a concurrent connection is still accessing it, leading to potential kernel memory corruption. This represents the first documented case of an LLM discovering a vulnerability requiring complex reasoning about concurrent execution paths, demonstrating that o3 has achieved a significant breakthrough in automated code analysis capabilities that can be utilized for bug hunting.

sean.heelan.io · 10 min

TLDR InfoSec

PATCHGUARD INTERNALS

PatchGuard (Kernel Patch Protection) is a Windows kernel mitigation introduced in 2005 that monitors critical kernel structures like IDT, GDT, MSRs, and SSDT, triggering a BSOD with error code 0x109 for unauthorized modifications. It employs randomized activation methods, such as timers and hidden DPCs, making its behavior unpredictable and hard to reverse engineer. Bypasses exist through boot-time patches and hypervisor-based rootkits that use Extended Page Tables (EPT) to hide changes, but both require disabling Secure Boot.

r0keb.github.io · 30 min

TLDR InfoSec

THE CLOUD HUNTING GAMES (WEB APP)

The Cloud Hunting Games is a capture-the-flag game developed by Wiz in which players investigate a simulated cloud ransomware attack.

cloudhuntinggames.com

TLDR InfoSec

FOSS TOOLS FOR INFRASTRUCTURE TESTING

A collection of open-source tools to test infrastructure. The highlighted tools include DNS tools, SSL/TLS tools, and mail servers.

bitfehler.srht.site · 3 min

TLDR InfoSec

SMART CARS, DUMB PASSWORDS: AUTO INDUSTRY STILL RUNS ON WEAK PASSWORDS

Many car companies rely on weak and reused passwords like "123456" for system security, making them vulnerable to hackers. This lax security puts smart cars and sensitive company data at risk. Experts recommend stronger passwords, employee training, and multi-factor authentication to enhance protection against cyberattacks.

hackread.com · 2 min

TLDR InfoSec

MICROSOFT WANTS WINDOWS UPDATE TO HANDLE ALL APPS

Microsoft has announced that it is opening up the Windows Update system to developers via a new orchestration platform. Hooking into the Windows Update orchestration platform will allow developers to take advantage of scheduled updates based on user activity, battery status, and even sustainable energy timing. Developers can also make use of the Windows Update notifications.

theverge.com · 3 min

TLDR InfoSec

GOOGLE ADDRESSES 34 HIGH-SEVERITY VULNERABILITIES IN JUNE'S ANDROID SECURITY UPDATE

Google's June Android update fixes 34 high-severity security flaws, including one that could let attackers gain extra control with user help.

cyberscoop.com · 2 min

TLDR InfoSec

THE PATH TO MEMORY SAFETY IS INEVITABLE

Achieving memory safety requires a multi-faceted approach that goes beyond switching to memory safe languages.

hardenedlinux.org · 9 min