The Daily Index — Friday, September 5, 2025

GENERAL

TLDR InfoSec

trial today

Summary unavailable

bitwarden.com

TLDR InfoSec

CHESS.COM DISCLOSES RECENT DATA BREACH VIA FILE TRANSFER APP

Chess.com reported that it experienced a data breach after detecting unauthorized data stored in a third-party file transfer application. The incident only impacts an estimated 4.5K users and may have exposed names and other PII.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW TP-LINK ZERO-DAY SURFACES AS CISA WARNS OTHER FLAWS ARE EXPLOITED

TP-Link has confirmed the existence of an unpatched zero-day vulnerability impacting multiple routers. The vulnerability was discovered by a security researcher who stated that it is caused by a stack buffer overflow in the CPE WAN Management Protocol (CWMP). An attacker could exploit it by redirecting vulnerable devices to a malicious CWMP server, which could deliver an oversized SOAP payload, leading to remote code execution.

bleepingcomputer.com · 2 min

TLDR InfoSec

MALICIOUS NPM PACKAGES USE ETHEREUM BLOCKCHAIN FOR MALWARE DELIVERY

Attackers deployed fake GitHub repositories and npm packages that stored malware download URLs in Ethereum smart contracts rather than directly in the code, making detection significantly harder for security tools. The campaign targeted cryptocurrency developers with fake automated trading bots, using packages like colortoolsv2 and mimelib2 that connected to blockchain addresses to retrieve second-stage payloads. The attackers automated thousands of fake commits daily to inflate repository legitimacy, demonstrating sophisticated supply chain attack techniques that combine social engineering with blockchain-based evasion.

csoonline.com · 3 min

TLDR InfoSec

SUBVERTING CODE INTEGRITY CHECKS TO LOCALLY BACKDOOR SIGNAL, 1PASSWORD, SLACK, AND MORE

A new vulnerability in popular Electron-based apps like Signal, 1Password, and Slack allows attackers to get around code integrity checks by hiding backdoors in overlooked V8 heap snapshot files. Electron's integrity protections often miss these files, meaning backdoors can be inserted without failing code signatures or integrity checks, especially when apps are installed in user-writable folders. This post shows a proof of concept to demonstrate keylogging and privilege escalation with the exploit, showing that even patched applications may have missed attack surfaces.

blog.trailofbits.com · 4 min

TLDR InfoSec

FINDING MORE ZERO DAYS THROUGH VARIANT ANALYSIS

Summary unavailable

semgrep.dev · 12 min

TLDR InfoSec

TIDAL CYBER (PRODUCT LAUNCH)

Tidal Cyber maps tactics, techniques, procedures, and procedural-level insights to MITRE ATT&CK to tailor security strategies around adversary groups and their behavior for threat-led defenses.

tidalcyber.com

TLDR InfoSec

POLICE DISRUPTS STREAMEAST, LARGEST PIRATED SPORTS STREAMING NETWORK

Egyptian authorities and the Alliance for Creativity and Entertainment (ACE) shut down Streameast, the world's largest illegal sports streaming platform that received 136 million monthly visits across 80 domains, arresting two suspects and seizing assets linked to $6.2 million in laundered advertising revenue.

bleepingcomputer.com · 3 min

TLDR InfoSec

JURY ORDERS GOOGLE TO PAY $425 MILLION FOR VIOLATING USER PRIVACY

A California jury found Google liable for collecting user data even after tracking was disabled, resulting in a $425 million penalty. The class action lawsuit covered 98 million users and claimed Google continued to gather app activity despite settings meant to protect privacy.

theverge.com · 2 min

TLDR InfoSec

FRANCE FINES GOOGLE, SHEIN FOR UNDERCOOKED COOKIE POLICIES THAT LED TO CRUMMY PRIVACY

France's data authority fined Google €325M and SHEIN €150M for using cookies without user consent and breaching privacy laws. Google was also penalized for showing ads in Gmail based on those cookies. Meanwhile, SHEIN's opt-out failed as cookies were still sent even when users clicked “Reject All.”

theregister.com · 2 min

TLDR InfoSec

TEXAS SUES POWERSCHOOL OVER BREACH COMPROMISING INFO OF OVER 880,000 STUDENTS, TEACHERS

Texas Attorney General Ken Paxton filed suit against education software provider PowerSchool for a December 2024 data breach that exposed personal information of more than 880,000 Texas students and teachers, alleging the company failed to implement adequate security measures despite knowing about vulnerabilities.

databreaches.net · 2 min

TLDR InfoSec

DISNEY TO PAY $10M TO SETTLE CLAIMS IT COLLECTED KIDS' DATA ON YOUTUBE

Disney agreed to pay $10 million to settle FTC claims that it mislabeled child-directed YouTube videos as "Not Made for Kids," which enabled unlawful collection of children's personal data and targeted advertising without parental consent in violation of COPPA regulations.

bleepingcomputer.com · 1 min

TLDR InfoSec

FREEBSD PROJECT ISN'T READY TO LET AI COMMIT CODE JUST YET

The FreeBSD Project is developing a policy to restrict LLM-generated code contributions due to licensing concerns, though AI may still be allowed for documentation, translations, and code analysis tasks.

go.theregister.com · 2 min