The Daily Index — Wednesday, October 22, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MUJI'S MINIMALIST CALM SHATTERED AS RANSOMWARE TAKES DOWN LOGISTICS PARTNER

A ransomware attack on logistics partner Askul forced Japanese retailer Muji to suspend online orders, affecting customers and disrupting services. With Askul's systems nearly paralyzed, many functions, including shipments and customer support, are down. No ransomware group has claimed responsibility.

theregister.com · 3 min

TLDR InfoSec

VULNERABILITY IN DOLBY DECODER CAN ALLOW ZERO-CLICK ATTACKS

Researchers from Google's Project Zero discovered a vulnerability in Dolby's Unified Decoder that could lead to remote code execution. Dolby Decoder is used by Android to locally decode all audio messages and attachments. The vulnerability is caused by a buffer overflow.

securityweek.com · 2 min

TLDR InfoSec

ANALYSING CLICKFIX: 3 REASONS WHY COPY/PASTE ATTACKS ARE DRIVING SECURITY BREACHES

ClickFix attacks trick users into copying and pasting malicious commands from fake CAPTCHA prompts in web browsers, which are then executed locally on their devices, with attacks spreading primarily through SEO poisoning and malvertising rather than email. These attacks exploit three key weaknesses: users lack awareness training for copy-paste threats, detection evasion techniques bypass email scanners and web proxies by using non-email delivery vectors and heavily obfuscated code, and EDR becomes the sole defense layer since malicious clipboard actions occur within the browser sandbox, invisible to traditional security tools. Security professionals should implement browser-based detection for malicious copy-paste operations, enhance user training to recognize fake CAPTCHA prompts, and deploy comprehensive endpoint monitoring since EDR remains the only reliable detection point after users execute the commands.

thehackernews.com · 7 min

TLDR InfoSec

LINUX CAPABILITIES REVISITED

Linux capabilities enable fine-grained privilege management by dividing root powers into independent units, but attackers can abuse this by setting capabilities like cap_setuid on binaries (e.g., Python) to create stealthy backdoors without traditional SUID bits. Security teams should expand privilege escalation hunting beyond SUID/SGID files to include capability-enabled binaries using getcap -r / and monitor for setcap usage, as capabilities are stored in file inodes under security.capability attributes invisible to standard ls commands. Tools like LinPEAS and Elastic's detection rule for setcap utility usage help identify suspicious capability assignments, while getfattr can reveal hidden extended attributes that getcap decodes into human-readable capability flags.

dfir.ch · 4 min

TLDR InfoSec

MICROSOFT 365 COPILOT – ARBITRARY DATA EXFILTRATION VIA MERMAID DIAGRAMS

Microsoft 365 Copilot was vulnerable to a security flaw that allowed sensitive business data, like recent emails, to be exfiltrated using specially crafted documents. Attackers could embed hidden instructions and a fake login button, which used Mermaid diagrams to send encoded company data to servers under their control if a user clicked the button. Microsoft fixed the vulnerability by disabling interactions with dynamic Mermaid diagram content, effectively closing this exfiltration route.

adamlogue.com · 5 min

TLDR InfoSec

TERRA SECURITY (PRODUCT LAUNCH)

Terra Security offers an agentic-AI-powered continuous penetration testing platform that deploys swarms of AI agents to simulate real-world attacks, providing tailored and scalable vulnerability assessments so organizations can address risks before attackers exploit them.

terra.security

TLDR InfoSec

NETWORK SECURITY DEVICES ENDANGER ORGS WITH '90S ERA FLAWS

Network edge devices like firewalls, VPNs, and email gateways have become major security liabilities, with nearly one in three of the 75 zero-day vulnerabilities tracked by Google in 2024 targeting these appliances. The exploited vulnerabilities consist primarily of basic 1990s-era flaws such as buffer overflows, command injections, and SQL injections—vulnerability classes that have well-established prevention and detection controls, yet persist in security vendors' mission-critical codebases. Security professionals should prioritize patching network appliances immediately when vulnerabilities are disclosed, implement comprehensive logging and monitoring for edge devices, and pressure vendors to adopt modern secure development practices, including memory-safe languages and rigorous code auditing.

csoonline.com · 3 min

TLDR InfoSec

HUNDREDS OF MASKED ICE AGENTS DOXXED BY HACKERS, AS PERSONAL DETAILS POSTED ON TELEGRAM

The Com hacking collective leaked personal information of hundreds of US government employees, including 680 DHS officials, over 170 FBI email addresses, and 190+ Department of Justice officials on private Telegram channels, with unclear data origins. The doxxing coincides with DHS warnings about Mexican cartels allegedly targeting ICE and CBP agents with bounties, and hackers claimed interest in million-dollar rewards while threatening to target IRS officials next. Security professionals should implement enhanced operational security for government personnel, monitor dark web channels for leaked PII, and review data handling procedures to identify potential breach sources, particularly given The Com's history of high-profile attacks against MGM Resorts, Coinbase, and others.

bitdefender.com · 3 min

TLDR InfoSec

APPLE ALERTS EXPLOIT DEVELOPER THAT HIS IPHONE WAS TARGETED WITH GOVERNMENT SPYWARE

A former Trenchant (L3Harris subsidiary) iOS exploit developer received an Apple threat notification in March indicating his personal iPhone was targeted with mercenary spyware, potentially marking the first documented case of spyware developers being targeted by their own tools. The developer, pseudonymously called Jay Gibson, was fired from Trenchant weeks earlier after being accused of leaking Chrome zero-days despite working exclusively on iOS exploits, which he and former colleagues deny. Security professionals should note that Apple's threat notification system detects sophisticated targeting even when forensic analysis finds no infection traces, suggesting either failed attack attempts or increasingly stealthy spyware that leaves minimal forensic evidence.

techcrunch.com · 4 min

TLDR InfoSec

encouraged. Register now →

Summary unavailable

go.veeam.com

TLDR InfoSec

MAJOR AWS OUTAGE TAKES DOWN FORTNITE, ALEXA, SNAPCHAT, AND MORE

A major AWS outage disrupted multiple high-profile services, including Fortnite, Alexa, and Snapchat, highlighting the critical dependency risks and single points of failure that organizations face when relying on centralized cloud infrastructure providers.

theverge.com · 1 min