TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 6 stories
  3. Page 3: TLDR AITLDR AI · 10 stories
  4. Page 4: TLDR AI — continuedTLDR AI · 9 stories
  5. Page 5: TLDR Web DevTLDR Web Dev · 7 stories
  6. Page 6: TLDR InfoSecTLDR InfoSec · 12 stories
  7. Page 7: TLDR CryptoTLDR Crypto · 10 stories
  8. Page 8: TLDR DesignTLDR Design · 12 stories
  9. Page 9: TLDR FoundersTLDR Founders · 10 stories
  10. Page 10: TLDR MarketingTLDR Marketing · 10 stories
  11. Page 11: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 16 stories
  12. Page 12: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders · 8 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 6

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

WINRAR ZERO-DAY EXPLOITED TO PLANT MALWARE ON ARCHIVE EXTRACTION

Researchers from ESET discovered a new WinRAR vulnerability that is being actively exploited in phishing campaigns. Unpatched versions of WinRAR and Windows versions of UnRAR, RAR, and UnRAR.dll can be tricked into using a path specified by a maliciously crafted archive file as the extraction directory. This vulnerability is being exploited by the Russian hacking group RomCom to install malware.

bleepingcomputer.com · 2 min

TLDR InfoSec

LINUX-BASED LENOVO WEBCAMS' FLAW CAN BE REMOTELY EXPLOITED FOR BADUSB ATTACKS

Security researchers discovered vulnerabilities in Lenovo 510 FHD and Performance FHD webcams that allow attackers to remotely transform them into BadUSB devices capable of injecting keystrokes and installing malware. The Linux-based webcams lack firmware validation, enabling complete compromise and persistent re-infection even after system wipes and OS reinstalls. Lenovo has released firmware version 4.8.0 to address the vulnerabilities following responsible disclosure in April.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

REPEATER STRIKE: MANUAL TESTING, AMPLIFIED

Gareth Heyes of PortSwigger writes about his experience writing a Burp Suite AI extension to automate hunting for IDOR and similar vulnerabilities. The extension, Repeater Strike, scans requests and responses to generate regular expressions that can be used to identify vulnerabilities in your traffic. While the extension worked in small tests, the AI struggled with longer responses, creating regular expressions that aren't site specific, and detecting more complex vulnerabilities.

portswigger.net · 5 min

TLDR InfoSec

I SPY: ESCALATING TO ENTRA ID'S GLOBAL ADMIN WITH A FIRST-PARTY APP

Researchers from DataDog discovered an attack vector where an attacker could abuse an Entra ID service principal (SP) with the Cloud Application Administrator or Application Administrator roles or the `Application.ReadWrite.All` permission to obtain global admin. The attacker uses the compromised SP to hijack the Office 365 Exchange Online SP to add a new federated domain, which they can then abuse to log in as any hybrid user. The researchers reported this vulnerability to Microsoft, but it was dismissed as a configuration issue.

securitylabs.datadoghq.com · 10 min

TLDR InfoSec

WHY XSS PERSISTS IN THIS FRAMEWORKS ERA?

Modern frameworks block most HTML XSS through automatic escaping, but XSS persists when developers bypass protections with WYSIWYG editors, markdown parsers, or flawed sanitizers. Frameworks don't guard against JavaScript XSS via URL attributes (href/src with javascript:) or eval in OAuth flows, redirects, or postMessage. Even trusted libraries may cause XSS if misused, and defenses like CSP and WAF are often bypassed, so developers must treat all input as untrusted and reliably use protections.

flatt.tech · 24 min

TLDR InfoSec

SIMPLIFY ACCESS REVIEWS WITH TRELICA BY 1PASSWORD

Trelica by 1Password introduced an access review feature that automates SaaS user access audits across 350+ API integrations, custom applications via APIs, and non-SCIM apps through CSV uploads. It offers a standardized workflow with context (roles, access levels, and issues), automated reviewer notifications, and inline actions for deactivating users or updating permissions. Reviews produce exportable audit reports with reviewer details and notes to meet compliance standards like SOC 2, SOX, PCI DSS, and ISO 27001.

blog.1password.com · 4 min

TLDR InfoSec

API KEYS FOR BEDROCK: A BRIEF SECURITY OVERVIEW

AWS has introduced the ability to create Bedrock API keys, which are special API keys that are explicitly scoped to Bedrock. Long-term API keys are tied to an automatically generated or existing IAM user, can be configured with an expiration of up to 100 years, and are composed of a magic 3-byte prefix, a human-readable section, and a base64-encoded secret. Short-term API keys are scoped to a specific user's session and have the format `bedrock-api-key-[BASE64]` where [BASE64] is a base64-encoded pre-signed URL.

medium.com · 5 min

TLDR InfoSec

RESEARCHERS UNCOVER GPT-5 JAILBREAK AND ZERO-CLICK AI AGENT ATTACKS EXPOSING CLOUD AND IOT SYSTEMS

Researchers from NeuralTrust demonstrated a jailbreak against GPT-5 using "Echo Chamber" and storytelling to bypass ethical guardrails, poisoning context to generate prohibited instructions without triggering refusals. Zenity Labs revealed "AgentFlayer" attacks exploiting ChatGPT Connectors, Cursor AI, and Microsoft Copilot via prompt injections in documents, tickets, or emails to exfiltrate data like API keys. These reveal how AI connected to external systems increases attack surfaces, with Tel-Aviv University showing smart home hijacking via poisoned calendar invites to Google's Gemini AI.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

KREBSONSECURITY IN NEW 'MOST WANTED' HBO MAX SERIES

Brian Krebs will be featured in a new four-part HBO Max series about Finnish cybercriminal Julius Kivimäki, who was recently sentenced to over six years for extorting a psychotherapy clinic and its patients. The series explores Kivimäki's hacking career from age 14, including DDoS attacks, swatting, and blackmailing 22,000 therapy patients. Titled "Most Wanted: Teen Hacker," it will air weekly on Fridays throughout September across multiple regions.

krebsonsecurity.com · 4 min

TLDR IndexPage 6