The Daily Index — Thursday, October 30, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

LG UPLUS IS LATEST SOUTH KOREAN TELCO TO CONFIRM CYBERSECURITY INCIDENT

LG Uplus, one of South Korea's largest telecom operators, has reported a suspected data breach to Korea's national cybersecurity watchdog KISA, but did not say when the results of its investigation would be available. All three major Korean telcos have faced recent cyber incidents, raising concerns about the country's digital defenses.

techcrunch.com · 2 min

TLDR InfoSec

AD AND PR GIANT DENTSU SAYS HACKERS STOLE MERKLE DATA

Japanese advertising giant Dentsu has revealed that its subsidiary, Merkle, suffered a data breach that exposed sensitive information about clients, suppliers, and employees. The breach was detected following abnormal activity on Merkle's network, leading to some systems being shut down.

securityweek.com · 3 min

TLDR InfoSec

LEVERAGING MACHINE LEARNING TO ENHANCE ACOUSTIC EAVESDROPPING ATTACKS (PART 1 OF 4)

Researchers demonstrated that machine learning can significantly enhance acoustic side-channel attacks by analyzing keyboard typing sounds to reconstruct typed text with high accuracy, exploiting acoustic emanations from physical keystrokes captured via microphones or smartphones. The attacks leverage ML models trained on keystroke audio patterns to classify individual key presses, achieving reconstruction rates that pose realistic threats to password and sensitive data entry in shared or public spaces. Security professionals should educate users about acoustic eavesdropping risks in public environments, consider acoustic shielding for sensitive areas, and promote authentication methods less vulnerable to acoustic side-channels like biometrics or hardware tokens, rather than typed passwords.

cc-sw.com · 1 min

TLDR InfoSec

HACKING WITH AI SASTS: AN OVERVIEW OF “AI SECURITY ENGINEERS”/“LLM SECURITY SCANNERS” FOR PENETRATION TESTERS AND SECURITY TEAMS

An exploration of Almanax, Corgea, and ZeroPath Security's AI SAST capabilities. The post uses three steps in its evaluation: code retrieval and indexing, code scanning, and false positive detection, deduplication, and severity rating, along with some miscellaneous items like the ease of using the UIs. The author concludes that ZeroPath is the best out of the products tested, followed by Corgea and Almanax.

joshua.hu · 12 min

TLDR InfoSec

LOLMIL: LIVING OFF THE LAND MODELS AND INFERENCE LIBRARIES

PromptLock is a proof-of-concept malware developed by NYU researchers to operate autonomously using an LLM hosted by the researchers. The author of this post wanted to experiment with building a post-exploitation tool that leverages the LLM included in Microsoft's Copilot+ PCs to create malware that's not dependent on a Command and Control (C2) Server. By providing the malware with tools to identify, modify, and restart vulnerable services, they were able to exploit two services using the LLM in a test environment.

dreadnode.io · 8 min

TLDR InfoSec

KEEPING THE INTERNET FAST AND SECURE: INTRODUCING MERKLE TREE CERTIFICATES

Cloudflare and Chrome are testing Merkle Tree Certificates (MTCs) to improve post-quantum signature performance, which are 20 times larger than current ECDSA signatures (ML-DSA-44 signatures are 2,420 bytes vs 64 bytes for ECDSA-P256). MTCs reduce TLS handshakes to one signature, one public key, and one Merkle inclusion proof by batching certificates into Merkle trees with signed tree heads sent out-of-band to clients, compared to today's five signatures and two public keys per handshake. The deployment will use "bootstrap certificates" from trusted CAs to validate MTCs via certificate transparency, starting early 2026 with some Cloudflare and Chrome users to assess performance and ossification issues.

blog.cloudflare.com · 12 min

TLDR InfoSec

CYBERRIDGE (PRODUCT LAUNCH)

CyberRidge has developed a plug-and-play photonic encryption system that transforms transmitted data into encrypted optical noise. This shields data from interception, quantum analysis, and “harvest now, decrypt later” attacks, aiming for post-quantum secure data transmission.

cyber-ridge.com

TLDR InfoSec

SSH LLM HONEYPOT CAUGHT A REAL THREAT ACTOR

A Beelzebub LLM-powered SSH honeypot successfully detected a genuine threat actor who downloaded Perl backdoor scripts from a compromised Joomla site. The attacker attempted to establish IRC-based command-and-control (C&C) connections using "rootbox PerlBot v2.0" on Undernet channels #rootbox and #c0d3rs-TeaM. Their tactics, techniques, and procedures (TTPs) included downloading malware to /tmp, attempting to escalate privileges with sudo, and deploying botnet agents that connected to ix1.undernet.org:6667 for C&C operations. Security teams can utilize LLM honeypots to gather real-time threat intelligence and disrupt botnets by analyzing malware configurations and reporting C&C infrastructure to hosting providers.

beelzebub.ai · 3 min

TLDR InfoSec

9 IN 10 EXCHANGE SERVERS IN GERMANY STILL RUNNING OUT-OF-SUPPORT SOFTWARE

Germany's cybersecurity agency warns that over 90% of Exchange servers in the country are using software that no longer receives support or updates. This leaves thousands of organizations, including hospitals and public institutions, vulnerable to critical security threats and ransomware. Microsoft offers extended updates for a limited time, but officials urge urgent upgrades or migration to avoid total network compromise.

theregister.com · 3 min

TLDR InfoSec

HACKERS USE NFC RELAY MALWARE TO CLONE TAP-TO-PAY ANDROID TRANSACTIONS

Zimperium researchers discovered over 760 malicious Android apps exploiting NFC and Host Card Emulation features to relay payment card data in real-time to attackers via 70+ command-and-control servers and Telegram bots, with fake banking apps impersonating Google Pay, VTB Bank, and Santander across Russia, Poland, Brazil and other countries to enable fraudulent tap-to-pay transactions without physical card access, prompting recommendations to download apps only from Google Play Store and implement stronger NFC permission controls.

hackread.com · 2 min

TLDR InfoSec

US TEEN INDICTED IN 764 NETWORK CASE INVOLVING EXPLOITATION CRIMES

A 19-year-old California man faces federal charges for alleged involvement in the extremist "764" network, a Nihilistic Violent Extremist group focused on exploiting minors and collapsing social norms.

hackread.com · 2 min

TLDR InfoSec

CANADA SAYS HACKTIVISTS BREACHED WATER AND ENERGY FACILITIES

Canadian authorities report multiple opportunistic hacktivist breaches of internet-exposed Industrial Control Systems at critical infrastructure facilities.

bleepingcomputer.com · 2 min