TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 9 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR ProductTLDR Product · 10 stories
  8. Page 8: TLDR DesignTLDR Design · 10 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR, TLDR Web Dev, TLDR InfoSec, TLDR Design · 10 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR InfoSec, TLDR Product, TLDR Marketing · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

EXPLOITING SELF-XSS USING DISK CACHE

Security researchers have developed a novel technique to exploit self-XSS vulnerabilities by combining login CSRF attacks with browser disk cache manipulation. The attack works by forcing victims to log into attacker-controlled accounts, then using browser history navigation (`history.go(-2)`) to access cached victim data from previous sessions. Organizations can defend against this attack vector by implementing `Cache-Control: no-store` headers on sensitive endpoints to prevent disk cache exploitation.

mey-d.github.io · 5 min

TLDR InfoSec

OUR JOURNEY FROM FRAGILE SSH TO ZERO-TRUST CONNECTIONS

A Redditor shares their journey building an open-source alternative to tools like Vercel and Railway. Initially, users would bring their own servers and provide keys in the UI. However, due to privacy and security concerns, dflow added the ability to purchase servers via AWS, along with a free promo program that was quickly abused. They later discovered that they could use Tailscale to allow servers to dynamically join their network with one command, or even automatically as part of their Dockerfile, without the need to exchange SSH keys.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

INTRODUCING SRA VERIFY – AN AWS SECURITY REFERENCE ARCHITECTURE ASSESSMENT TOOL

SRA Verify is an open-source security assessment tool that validates AWS environments against the Security Reference Architecture through automated checks across CloudTrail, GuardDuty, Config, Security Hub, and other services. The tool maps directly to AWS SRA recommendations and helps organizations verify that their multi-account security implementations align with AWS best practices. Teams can use the GitHub repository for infrastructure-as-code examples to remediate identified gaps.

aws.amazon.com · 3 min

TLDR InfoSec

APT36: A PHISHING CAMPAIGN TARGETING INDIAN GOVERNMENT ENTITIES

APT36 (Transparent Tribe), a Pakistan-linked threat group, is conducting a sophisticated phishing campaign against Indian government entities using typo-squatted domains that mimic official portals to harvest credentials and bypass Kavach MFA. The operation employs real-time OTP harvesting with C2 infrastructure hosted on Pakistani servers and coordinated domain registrations, indicating state-sponsored backing. Organizations should immediately block identified IOCs, including the domains mgovcloud[.]in and virtualeoffice[.]cloud, as well as associated IP addresses.

cyfirma.com · 8 min

TLDR InfoSec

NORTH KOREA SENT ME ABROAD TO BE A SECRET IT WORKER. MY WAGES FUNDED THE REGIME

North Korea sends thousands of IT workers abroad to secure remote jobs at Western companies using hundreds of fake identities, generating $250-600 million annually for the state. The workers use stolen identities from European citizens to apply for US and European tech jobs, often resulting in multiple North Koreans unknowingly hired by the same company. An estimated 85% of earnings are sent back to fund the regime. Security firms report interviewing dozens of suspected North Korean IT workers who use AI face-swapping technology and work from locations where it's never daytime during supposed US business hours.

bbc.com · 10 min

TLDR IndexPage 5