The Daily Index — Wednesday, October 15, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SATELLITES FOUND EXPOSING UNENCRYPTED DATA, INCLUDING PHONE CALLS AND SOME MILITARY COMMS

Sensitive personal, corporate, and military data is being transmitted unencrypted via about half of Earth's geostationary satellites, according to researchers. Using a basic satellite receiver, they accessed voice calls, texts, and critical infrastructure communications, exposing serious privacy and security risks.

techcrunch.com · 1 min

TLDR InfoSec

PIXEL-STEALING “PIXNAPPING” ATTACK TARGETS ANDROID DEVICES

“Pixnapping” is an advanced attack where a malicious Android app can secretly steal individual pixels from your device's screen—enabling it to extract sensitive data like 2FA codes, even from supposedly secure apps. The attack exploits Android's app messaging system and nearly invisible overlays.

malwarebytes.com · 3 min

TLDR InfoSec

WHY SIGNAL'S POST-QUANTUM MAKEOVER IS AN AMAZING ENGINEERING ACHIEVEMENT

Signal Messenger has rolled out a major upgrade to its encryption protocol, making it resistant to future quantum computer attacks. This technical overhaul adds a third layer—a quantum-safe ratchet—to its already-robust system to ensure strong privacy even if classical encryption breaks. Thanks to clever use of chunking methods and erasure codes, Signal's triple ratchet protects users' messaging by combining classic and quantum-safe security mechanisms, all without impacting everyday use.

arstechnica.com · 9 min

TLDR InfoSec

WHY UNMONITORED JAVASCRIPT IS YOUR BIGGEST HOLIDAY SECURITY RISK

Client-side JavaScript attacks pose a critical blind spot for e-commerce security as 73% of sites load 50+ third-party scripts on checkout pages while only 23% use dedicated client-side monitoring, allowing attackers to steal payment data through browser-based skimmers that bypass WAFs and traditional server-side defenses entirely. Major 2024 attacks, including the Polyfill.io breach affecting over 500,000 websites and Cisco's Magecart incident, demonstrate how compromised third-party scripts and supply chain vulnerabilities enable data theft that often goes undetected for an average of 7.5 months, with incidents costing $2.4 million plus regulatory fines. Security teams should immediately implement Content Security Policy with nonces (avoiding ‘unsafe-inline'), deploy Subresource Integrity tags for third-party scripts, establish comprehensive script inventories with regular audits, and deploy specialized client-side monitoring tools to detect unauthorized data collection, DOM manipulation, and suspicious script behavior before the 2025 holiday shopping season.

thehackernews.com · 5 min

TLDR InfoSec

HOW DO TIMING ATTACKS WORK?

Timing attacks that target string comparison work by measuring how long it takes a vulnerable server to verify a string, such as a password or other secret. When a vulnerable function compares two strings, it loops through each character to check for equality, causing the function to take slightly longer to complete with each correct character. The page includes a demo for how this attack works in practice.

nickg.ca · 3 min

TLDR InfoSec

HERE'S HOW APPLE IS LOCKING DOWN IPHONES TO COMPLY WITH TEXAS' AGE VERIFICATION LAW

Starting next year, Texas will require companies to verify the ages of people who use their app stores. Apple has announced that beginning January 1, Texans trying to create a new Apple Account must confirm their age. If they are under 18, they must join a Family Sharing group. Parents and guardians will be required to give their consent to download apps or make in-app purchases, and developers will be required to implement the Declared Age Range API.

theverge.com · 3 min

TLDR InfoSec

DISCORD BLAMED A VENDOR FOR ITS DATA BREACH — NOW THE VENDOR SAYS IT WAS ‘NOT HACKED'

Discord reported a breach impacting 70,000 users, claiming a third-party vendor, 5CA, was responsible, but 5CA denies any hacking of its systems or handling of government ID photos. The company argues the incident likely resulted from human error outside its systems, and both parties are conducting ongoing investigations to clarify further responsibility and the extent of affected data.

theverge.com · 2 min

TLDR InfoSec

ASAHI BREACH LEAVES BITTER TASTE AS BREWER FEARS PERSONAL DATA SLURPED

Japanese beer maker Asahi suffered a ransomware attack in late September that disrupted operations across Japan and may have resulted in unauthorized access to personal information. The ransomware group Qilin claims to have stolen 27 GB of data, including employee and financial records.

theregister.com · 3 min

TLDR InfoSec

MASSIVE MULTI-COUNTRY BOTNET TARGETS RDP SERVICES IN THE US

A large-scale botnet comprising over 100,000 IP addresses is conducting coordinated attacks against Remote Desktop Protocol services in the United States.

bleepingcomputer.com · 1 min

TLDR InfoSec

UK NCSC REPORTS 429 CYBERATTACKS IN A YEAR, WITH NATIONALLY SIGNIFICANT CASES MORE THAN DOUBLING

The UK's National Cyber Security Centre reported 429 cyberattacks from September 2024 to August 2025, with significant incidents more than doubling from 89 to 204, and highly significant incidents rising nearly 50% to 18, posing severe risks to essential services.

securityaffairs.com · 2 min

TLDR InfoSec

WORKFORCE TERMINATION ORDERS AFFECT SEVERAL CISA DIVISIONS

Several divisions of CISA are facing job cuts as part of a government plan to reduce staff during a shutdown, amid criticism from the administration over its work combating misinformation.

links.tldrnewsletter.com · 1 min