The Daily Index — Monday, November 17, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DOORDASH HIT BY NEW DATA BREACH IN OCTOBER EXPOSING USER INFORMATION

DoorDash disclosed a data breach orchestrated by an unauthorized third party that accessed internal data through the social engineering of an employee. The breached data includes first and last names, physical and email addresses, and phone numbers. Some victims have expressed outrage over the wording of the notice and the delay in notification.

bleepingcomputer.com · 2 min

TLDR InfoSec

LOGITECH CONFIRMS DATA BREACH AFTER CLOP EXTORTION ATTACK

Logitech confirmed that it suffered a data breach due to a zero-day flaw after the Clop ransomware group added it to its list of victims. The company stated that the data may include limited information on employees, consumers, customers, and suppliers, but the databases did not contain financial information or IDs.

bleepingcomputer.com · 2 min

TLDR InfoSec

WHEN THE IMPERSONATION FUNCTION GETS USED TO IMPERSONATE USERS (FORTINET FORTIWEB AUTH. BYPASS CVE-2025-64446)

Fortinet FortiWeb appliances are being actively exploited via CVE-2025-64446, a pre-auth RCE chain combining path traversal and authentication bypass that allows attackers to reach privileged CGI functions and impersonate users by crafting a base64-encoded CGIINFO header containing admin credentials. The vulnerability was silently patched in version 8.0.2 and affects multiple FortiWeb versions. It enables complete appliance compromise through administrative account creation. WatchTowr released a detection tool on GitHub to identify vulnerable hosts.

labs.watchtowr.com · 7 min

TLDR InfoSec

WTF IS… - AI-NATIVE SAST

Leveraging AI as a complement to a traditional SAST can significantly improve results by using RAG to inject context on specific vulnerability classes. AI and SAST solutions can be leveraged using prompt-and-code, prompt-and-agent, or tailored-prompt-and-SAST-result methods. This post examines ZeroPath as an example of an agent, code graph, and SAST MCP.

parsiya.net · 17 min

TLDR InfoSec

MAKING SERIALIZATION GADGETS BY HAND - .NET

Creating deserialization gadgets for .NET by hand requires understanding the structure of .NET serialization streams, which are composed of sequential records that define objects and references. By breaking down these records, including headers, class information, member types, and values, it becomes possible to craft custom gadget chains directly in code, without relying on pre-generated payloads or Windows-only tools. The approach presented demonstrates how to reconstruct objects, assign values, and embed complex references, providing insight into the safe and dynamic generation of deserialization payloads.

vulncheck.com · 1 min

TLDR InfoSec

DAYLIGHT (PRODUCT LAUNCH)

Daylight is an AI-powered Managed Detection and Response (MDR) platform that offers autonomous cyber threat hunting, analysis, and containment.

daylight.ai

TLDR InfoSec

BE CAREFUL RESPONDING TO UNEXPECTED JOB INTERVIEWS

Attackers are impersonating legitimate recruiters via LinkedIn and email, luring victims with fake job interviews that redirect to malicious sites hosting RMM tools disguised as meeting software updates. The phishing campaign uses social engineering tactics, including spoofed recruiter names from real companies, Gmail sender addresses instead of corporate domains, and shortened URL redirects to phishing infrastructure. Security teams should alert users to verify unsolicited recruitment contacts independently, scrutinize sender domains and meeting URLs, and block known malicious RMM tool distributions through endpoint security controls.

malwarebytes.com · 4 min

TLDR InfoSec

GOOGLE TO FLAG ANDROID APPS WITH EXCESSIVE BATTERY USAGE ON THE GOOGLE PLAY STORE

Google has announced that it will begin flagging apps on the Google Play Store that pass a defined bad behavior threshold. The Android vitals system will track partial wake locks, the cumulative time the app spends with background work while the screen is off, and prevent the device from entering sleep mode. Flagged apps will have a warning on their Play Store page and be excluded from prominent discovery surfaces such as recommendations.

bleepingcomputer.com · 2 min

TLDR InfoSec

HYUNDAI PAYWALLS BRAKE PAD CHANGES

Hyundai requires a $60/week NASTF subscription and $2,000 interface tool restricted to “service professionals” to retract electronic parking brakes for DIY brake pad replacement, forcing owners to use workarounds like Harbor Freight's T7 scan tool that trigger error codes.

hackaday.com · 2 min

TLDR InfoSec

POLICE TAKE DOWN THREE CYBERCRIME OPERATIONS IN LATEST ROUND OF 'WHACK-A-MOLE'

Authorities from nine countries coordinated by Europol dismantled three major cybercrime operations: Rhadamantys infostealer, Elysium botnet, and VenomRAT.

techcrunch.com · 2 min

TLDR InfoSec

AKIRA RANSOMWARE GROUP MADE $244 MILLION IN RANSOM PROCEEDS

The Akira ransomware group has amassed over $244 million since March 2023 by targeting organizations worldwide, particularly those utilizing VMware ESXi servers.

securityweek.com · 3 min