The Daily Index — Friday, October 24, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CRITICAL MCP SERVER FLAW EXPOSES OVER 3K SERVERS AND THOUSANDS OF API KEYS

Security researchers discovered a critical path traversal vulnerability in Smithery.ai, a popular MCP server hosting service. The researchers discovered that they could exploit a path traversal vulnerability in the dockerBuildPath configuration value to read files outside of their project. The researchers used this vulnerability to find a fly.io API token that granted root access to more than 3k applications.

gbhackers.com · 2 min

TLDR InfoSec

LG UPLUS REPORTS SUSPECTED DATA BREACH, CLAIMS ACTIVE RESPONSE TO “HACKING”

LG Uplus, one of South Korea's major mobile carriers, reported a data breach. The announcement follows a report from Phrack that a threat actor infiltrated LG Uplus' internal network and seized data from nearly 9k servers, including data of 42,256 accounts and 167 employees.

world.kbs.co.kr · 1 min

TLDR InfoSec

WHY ORGANIZATIONS ARE ABANDONING STATIC SECRETS FOR MANAGED IDENTITIES

Organizations are transitioning from static secrets (API keys, passwords, and tokens) to managed identities, achieving a 95% reduction in credential management time and a 75% reduction in learning platform-specific authentication. Major cloud providers (AWS IAM Roles, Azure Managed Identities, and GCP Service Accounts) now offer automated, short-lived credential provisioning that eliminates manual rotation and leakage risks. However, legacy systems and third-party APIs still require traditional secret management. Security teams should prioritize discovering existing credentials using NHI (Non-Human Identity) platforms before migration, aiming to reduce their secret footprint by 70-80% while maintaining robust secret management for remaining use cases.

thehackernews.com · 3 min

TLDR InfoSec

MODDING AND DISTRIBUTING MOBILE APPS WITH FRIDA

Frida enables powerful mobile app modifications by injecting custom agents into running processes. However, distributing these modifications for use by others—especially on non-rooted Android devices—requires embedding Frida's gadget library directly inside the APK. Using a demo app, this post walks through preparing an agent script that always rolls a 'one' in a dice app, compiling it, and patching the APK to include Frida's gadget for autonomous script execution.

pit.bearblog.dev · 6 min

TLDR InfoSec

COLLECTING IPHONE UNIFIED LOGS VIA MACOS

Unified logs are a forensic resource for iOS that includes granular background activity that can't be obtained in any other forensic artifact. The logs can be collected manually on a Mac via libimobiledevice or automatically using a script written by the author. The author provides suggestions for commercial and open-source tools to read the .logarchive, a structured bundle containing binary .tracev3 files.

sjdcforensics.com · 4 min

TLDR InfoSec

KEYCARD (PRODUCT LAUNCH)

Keycard provides an identity and access management platform for AI agents, enabling organizations to assign, track, and control AI agent permissions using cryptography, dynamic tokens, and runtime contextual access policies for secure, scalable agent deployment and visibility.

keycard.sh

TLDR InfoSec

META BOOSTS SCAM PROTECTION ON WHATSAPP AND MESSENGER

Meta introduced enhanced scam protections for WhatsApp and Messenger, including screen-sharing warnings during video calls with unknown contacts and on-device behavioral analysis to flag suspicious messages, with optional cloud-based AI review that breaks end-to-end encryption. The company removed over 21,000 fake customer support Facebook pages targeting users through comment monitoring on legitimate airline, travel agency, and bank accounts, part of broader scam trends targeting seniors with fake home remodeling and government debt relief schemes. Security teams should educate users, especially vulnerable populations, about enabling these protections, including Passkeys and Security Checkup features, while noting that cloud-based AI analysis compromises message encryption.

malwarebytes.com · 2 min

TLDR InfoSec

GOOGLE AND CHECK POINT NUKE MASSIVE YOUTUBE MALWARE NETWORK

A coordinated malware campaign on YouTube, known as the Ghost Network, exploited hijacked accounts to post fake tutorials promising cracked software and gaming cheats. These videos lured users into downloading infostealers, which stole credentials and crypto wallets. The operation relied on fake engagement and resilient tactics, leading Google and Check Point to remove over 3,000 malicious videos in a major crackdown.

theregister.com · 4 min

TLDR InfoSec

VIBE CODING'S REAL PROBLEM ISN'T BUGS—IT'S JUDGMENT

AI code generation enables rapid, large-scale software creation, but speed and flawed judgment are the real risks. While AI-made code has vulnerability rates similar to human work, issues like ineffective coding practices and skipped reviews mean more exposure to breaches, so experts urge integrating security directly into AI workflows and cultivating best usage practices.

securityweek.com · 3 min

TLDR InfoSec

MICROSOFT BUILDS ON RECALL WITH GAMING COPILOT — FAILS BASIC PRIVACY TESTS

Microsoft's new Gaming Copilot, built on Recall-like Copilot Vision technology, is being silently deployed to Windows 11 PCs without user consent or onboarding.

doublepulsar.com · 3 min

TLDR InfoSec

CANADA FINES CYBERCRIME FRIENDLY CRYPTOMUS $176M

Summary unavailable

krebsonsecurity.com · 2 min