The Daily Index — Friday, July 11, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MILLIONS OF CARS EXPOSED TO REMOTE HACKING VIA PERFEKTBLUE ATTACK

PCA Cyber Security discovered critical vulnerabilities in OpenSynergy's BlueSDK Bluetooth framework affecting millions of cars from Mercedes-Benz, Skoda, and Volkswagen. The "PerfektBlue" attack enables remote code execution through Bluetooth pairing, allowing attackers to track vehicles, record audio, access phonebook data, and potentially control steering/wipers.

securityweek.com · 2 min

TLDR InfoSec

CRITICAL MCP-REMOTE VULNERABILITY ENABLES REMOTE CODE EXECUTION, IMPACTING 437,000+ DOWNLOADS

CVE-2025-6514, a critical vulnerability in mcp-remote (CVSS 9.6), allows arbitrary OS command execution when connecting to untrusted MCP servers. The flaw affects versions 0.0.5-0.1.15 and has been patched in 0.1.16. Other MCP vulnerabilities allowing for remote code execution and sandbox escapes were also discovered in the Inspector tool and Anthropic's Filesystem MCP Server.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

HOW I DISCOVERED A LIBPNG VULNERABILITY 11 YEARS AFTER IT WAS PATCHED

While practicing secure code review, the author of this article decided to review the libpng C library. They found that libpng calculated memory allocations based on user-controlled values, such as “depth.” The author was able to trigger a crash using a custom PNG file, but then discovered that the bug was fixed 11 years ago when it was first reported.

blog.himanshuanand.com · 5 min

TLDR InfoSec

TAKING SHELLTER: A COMMERCIAL EVASION FRAMEWORK ABUSED IN- THE- WILD

Elastic Security Labs found threat actors using an illicit version of SHELLTER, a red team evasion framework, since April to deploy infostealers like LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The malware uses advanced evasion techniques such as polymorphic code, API hooking bypasses, indirect syscalls, memory scan evasion, and AMSI bypass, resulting in low detection rates. Elastic issued a dynamic unpacker and YARA rules to help detect SHELLTER samples, which are spread via YouTube comments and phishing campaigns targeting content creators.

elastic.co · 26 min

TLDR InfoSec

ABUSING CHROME REMOTE DESKTOP ON RED TEAM OPERATIONS: A PRACTICAL GUIDE

Red team operators can abuse Chrome Remote Desktop as a legitimate remote access tool by installing the MSI package with admin privileges and using an undocumented `--pin=111111` parameter to bypass GUI PIN setup requirements. The technique leverages Google's infrastructure and HTTPS/WebRTC protocols, making it more difficult to detect than traditional remote access tools, as it appears as legitimate Google traffic. Defenders should implement application allowlisting solutions, such as AppLocker, and monitor for "Chrome Remote Desktop Host" installations to prevent unauthorized remote access deployments.

trustedsec.com · 5 min

TLDR InfoSec

AIRMDR (PRODUCT LAUNCH)

AirMDR provides automated playbooks to investigate and respond to threats while constantly learning.

airmdr.com

TLDR InfoSec

BROWSER EXTENSIONS TURN NEARLY 1M BROWSERS INTO WEBSITE-SCRAPING BOTS

Browser extensions that use the MellowTel-js library are being used to scrape websites using users' browsers. The library has close ties with Olostep, a company that bills itself as “the world's most reliable and cost-effective Web scraping API,” suggesting that Olostep is using its installed base of extension users to fulfill scraping requests. 245 extensions that implement this library have been discovered across Chrome, Firefox, and Edge, with a total of nearly 1M users.

arstechnica.com · 4 min

TLDR InfoSec

GMX HALTS TRADING, TOKEN MINTING FOLLOWING $40M EXPLOIT

The GMX protocol halted trading on GMX V1, the first version of the GMX perpetual exchange deployed on the Arbitrum network, after a liquidity pool suffered an exploit that resulted in $40 million in funds being stolen. The attacked pool is a liquidity provider for the GMX protocol with underlying assets that include Bitcoin, Ether, and stablecoins. Blockchain security company SlowMist attributed the exploit to a design flaw that allowed hackers to manipulate the GLP token price.

cointelegraph.com · 3 min

TLDR InfoSec

AMD WARNS OF NEW MELTDOWN, SPECTRE-LIKE BUGS AFFECTING CPUS

AMD has discovered Transient Scheduler Attack (TSA) vulnerabilities affecting EPYC, Ryzen, and other chips that could potentially enable information disclosure through side-channel attacks requiring local access.

theregister.com · 3 min

TLDR InfoSec

SOUTH KOREAN GOVERNMENT IMPOSES PENALTIES ON SK TELECOM FOR BREACH

South Korea fined SK Telecom only $21,890 for a breach that exposed 27 million customer records, but imposed strict regulatory requirements, including quarterly security assessments, mandatory USIM replacements, and organizational changes that the company expects will cost $511 million in lost revenue.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

FOUR ARRESTED IN CONNECTION WITH M&S AND CO-OP CYBER-ATTACKS

The National Crime Agency detained four teenagers aged 17-19 for launching cyberattacks involving ransomware and data theft against M&S, Co-op, and Harrods, with charges including computer misuse, blackmail, and organized crime.

bbc.com · 4 min