The Daily Index — Monday, July 14, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

MCDONALD'S CHATBOT RECRUITMENT PLATFORM EXPOSED 64 MILLION JOB APPLICATIONS

McDonald's chatbot recruitment platform, McHire, exposed the personal data of over 64 million job applicants due to default credentials ('123456' username/password) and an insecure API. Security researchers accessed all applicant information, including names, addresses, phone numbers, and chat messages.

securityweek.com · 2 min

TLDR InfoSec

OVER 600 LARAVEL APPS EXPOSED TO REMOTE CODE EXECUTION DUE TO LEAKED APP_KEYS ON GITHUB

Cybersecurity researchers discovered that leaked Laravel APP_KEYs from GitHub can enable remote code execution attacks. Over 260,000 APP_KEYs were extracted from GitHub, with more than 600 vulnerable applications identified. When attackers obtain these encryption keys, they can exploit deserialization flaws to execute arbitrary code on servers, compromising data and infrastructure security.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

GROK-4 JAILBREAK WITH ECHO CHAMBER AND CRESCENDO

Researchers have shown that combining two LLM jailbreak techniques, Echo Chamber and Crescendo, enhances the ability to bypass AI safety measures more effectively than using either method separately. Experiments with Grok-4 on harmful tasks, like providing bomb-making instructions, achieved success rates ranging from 30% to 67%.

neuraltrust.ai · 4 min

TLDR InfoSec

ROLLING OUT SANTA WITHOUT FREEZING PRODUCTIVITY: TIPS FROM SECURING FIGMA'S FLEET

Figma successfully deployed Santa, an open-source binary authorization tool, across all employee laptops by running it in monitoring mode for months to build a comprehensive allowlist based on actual usage patterns. It minimized user disruption through a custom Slack-based self-service system that allows employees to quickly approve blocked applications after automated security checks, as well as an escape hatch that enables temporary monitoring mode during rollout. The phased deployment began with users having zero unknown binaries and gradually expanded to 100% coverage over three months, utilizing automated package rule generation and group-based policies to handle edge cases, such as developer tools.

figma.com · 12 min

TLDR InfoSec

HOW I FOUND A BYPASS IN GOOGLE'S BIG ANTI-ADBLOCK UPDATE

The author discovered a Chrome bug that allowed MV3 extensions to bypass Google's removal of webRequestBlocking (which kills adblockers) by exploiting legacy JavaScript bindings and creating fake webRequest events with spoofed WebView IDs. The exploit worked by using the constructor of existing webRequest events to create new events with the opt_webViewInstanceId parameter set, which skipped permission checks for webRequestBlocking since the browser never verified if the extension had WebView permissions. Google patched the vulnerability in Chrome 118 by adding proper permission validation, although it didn't award a bounty since it didn't expose new data to extensions.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

TRUSTIFI (PRODUCT LAUNCH)

The cloud-based email security solution leverages AI to scan emails for threats such as impersonation, spoofing, spear-phishing, and business email compromise.

links.tldrnewsletter.com

TLDR InfoSec

RECONSNAP (PRODUCT LAUNCH)

The platform enables automated digital change detection, capturing visual and structural changes on selected targets. This helps you track updates, detect anomalies, and react to potential threats before others.

reconsnap.com

TLDR InfoSec

GOOGLE GEMINI FOR WORKSPACE HIJACKS EMAIL SUMMARIES FOR PHISHING

A security researcher discovered an indirect prompt-injection attack on Google's Gemini model. The prompt injection attack involves including invisible instructions for Gemini in emails. When a user then uses Google Gemini for Workspace to summarize the email, Gemini will follow the instructions and may include phishing links or misinformation in its summary.

bleepingcomputer.com · 2 min

TLDR InfoSec

“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Meta deployed “localhost tracking” that bypassed Android security protections by using its mobile apps to listen on local network ports while tracking scripts in web browsers sent user identifiers via WebRTC, linking anonymous browsing activity to real Facebook/Instagram identities even when users employed VPNs, incognito mode, and deleted cookies. The scheme affected 22% of the world's most visited websites and collected complete browsing histories, purchases, and behavioral patterns without proper consent across billions of users over multiple years. Meta now faces potential fines of €32 billion under GDPR, DSA, and DMA regulations for violating data protection, personalized advertising restrictions, and rules governing the combination of cross-platform data.

zeropartydata.es · 12 min

TLDR InfoSec

SMM CALLOUT VULNERABILITIES IDENTIFIED IN GIGABYTE UEFI FIRMWARE MODULES

Four SMM callout vulnerabilities (CVE-2025-7026 through CVE-2025-7029) were found in Gigabyte UEFI firmware, allowing attackers with admin privileges to execute code in System Management Mode, bypassing OS protections and potentially disabling Secure Boot and Intel BootGuard. These flaws result from improper validation of CPU registers and pointers in SMI handlers, enabling malicious control over SMRAM writes and flash operations. Although they were previously fixed by AMI, these issues reappeared in Gigabyte's firmware, so users should urgently update to the latest UEFI from Gigabyte's support site.

kb.cert.org · 5 min

TLDR InfoSec

TELEGRAM MESSENGER'S TIES TO RUSSIA'S FSB REVEALED IN NEW REPORT

Russian investigative outlet IStories alleges that Telegram's server infrastructure is maintained by companies with ties to Russia's FSB intelligence service, potentially enabling surveillance of users' communications even when using VPNs and incognito mode, though Telegram denies the claims and maintains that no third parties have access to user data.

newsweek.com · 8 min

TLDR InfoSec

DONOT APT HITS EUROPEAN MINISTRY WITH NEW LOPTIKMOD MALWARE

The India-linked DoNot APT group targeted a European foreign affairs ministry by using spear-phishing emails impersonating defense officials to deliver its LoptikMod malware via Google Drive links, marking an expansion of its operations beyond its traditional South Asian focus.

hackread.com · 2 min

TLDR InfoSec

THIRTEEN ROMANIANS ARRESTED FOR PHISHING THE UK'S TAX SERVICE

Thirteen individuals in Romania and one in the UK were apprehended for executing a phishing scam targeting HMRC, which resulted in a theft of £47 million from taxpayers and impacted 100,000 HMRC customers.

securityweek.com · 2 min