TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 10 stories
  3. Page 3: TLDR AITLDR AI · 13 stories
  4. Page 4: TLDR DevTLDR Dev · 9 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 10 stories
  8. Page 8: TLDR FoundersTLDR Founders · 10 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 12 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 17 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

PORNHUB EXTORTED AFTER HACKERS STEAL PREMIUM MEMBER ACTIVITY DATA

The ShinyHunters extortion gang is extorting the adult video platform PornHub after stealing over 200M records of personal information in the Mixpanel breach. The breached data includes email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. PornHub stated that they have not worked with Mixpanel since 2021, so the stolen records are historical analytics data from 2021 or earlier.

bleepingcomputer.com · 2 min

TLDR InfoSec

A BROWSER EXTENSION RISK GUIDE AFTER THE SHADYPANDA CAMPAIGN

The ShadyPanda campaign compromised popular Chrome and Edge extensions after seven years of building trust, affecting 4.3 million users, and installed full RCE frameworks that could steal session tokens and hijack SaaS accounts, bypassing MFA. The attack demonstrated that browser extensions represent a critical blind spot between endpoint and cloud security, with silent auto-updates enabling overnight weaponization. Organizations should implement extension allow lists, treat extension permissions as OAuth access grants, conduct regular permission audits, and monitor for behavioral changes that indicate compromise.

thehackernews.com · 7 min

TLDR InfoSec

WHAT DATA DO CODING AGENTS SEND, AND WHERE TO?

As AI coding agents become more common, security teams should understand what data these tools collect and where it goes. Chaser Systems created a test environment with seven coding agents, testing actions such as starting the agent, tab autocomplete, creating new features, committing and pushing to a git repository, running tests, and uploading data to 0x0.st. They also checked access to AWS credentials and files outside the project directory. The article describes the domains contacted, sample requests, and data transfer volumes during tests conducted with telemetry both disabled and enabled, including scenarios where telemetry is enabled, but FQDNs are blocked.

chasersystems.com · 8 min

TLDR InfoSec

JUMPSHOT: XM CYBER UNCOVERS CRITICAL LOCAL PRIVILEGE ESCALATION (CVE-2025-34352) IN JUMPCLOUD AGENT

A critical flaw was found in the JumpCloud Remote Assist for Windows agent that lets any low-privileged user on a machine gain full SYSTEM-level control or crash the system entirely. The issue stems from the agent's uninstaller performing file creation, deletion, and execution in the user's %TEMP% directory, which an attacker can redirect using symbolic links and mount points to target protected system files. This enables both denial-of-service via driver corruption and full local privilege escalation through a race condition involving Windows Installer files, making rapid patching to version 0.317.0 or later essential for organizations using JumpCloud-managed Windows endpoints.

xmcyber.com · 10 min

TLDR InfoSec

ANNOUNCING XINT CODE

Theori's Xint Code, an AI-powered code analysis tool, discovered critical 0-day RCE vulnerabilities in Redis, PostgreSQL, and MariaDB with zero human intervention at ZeroDay Cloud, sweeping the database category and outperforming all human teams. The tool analyzes source code, configuration files, and binaries without packaging or harnessing requirements, producing actionable reports with dramatically fewer false positives than traditional static analysis while identifying vulnerabilities missed by humans for decades. Theori is seeking early partners to validate findings on real codebases before broader rollout.

theori.io · 3 min

TLDR InfoSec

SVG FILTERS - CLICKJACKING 2.0

A novel clickjacking technique leverages SVG filters applied to cross-origin iframes to read pixel colors, hide or manipulate UI elements, and execute logic gates for complex multi-step attacks without JavaScript. The technique enables data exfiltration through fake captchas, dynamic attack overlays that respond to iframe state changes, and even QR code generation to encode stolen data for mobile exfiltration. Security teams should note that traditional X-Frame-Options and CSP frame-ancestors remain the primary defenses, as this attack only works against frameable pages.

lyra.horse · 20 min

TLDR InfoSec

NO, SOUNDCLOUD HASN'T STARTED TUNING OUT VPNS. IT'S MOPPING UP AFTER A CYBERATTACK

SoundCloud detected unauthorized access to an internal dashboard, triggering incident response and outside forensics support. Attackers accessed email addresses and public-profile data for roughly 20 percent of users, but no passwords or financial information. The company also faced web-only DDoS attacks, and later configuration changes accidentally disrupted some VPN users, sparking false rumors that SoundCloud was banning VPN access.

theregister.com · 3 min

TLDR InfoSec

SANTASTEALER IS COMING TO TOWN: A NEW, AMBITIOUS INFOSTEALER ADVERTISED ON UNDERGROUND FORUMS

SantaStealer is a new malware-as-a-service info‑stealer advertised in Telegram channels and forums that can exfiltrate documents, credentials, crypto wallets, and other sensitive data from numerous applications. It uses a modular, multi-threaded design that runs mostly in memory. The software gathers data from browsers, messaging apps, and gaming platforms, zips everything, splits it into 10 MB chunks, and sends it over unencrypted HTTP to attacker-controlled servers.

rapid7.com · 6 min

TLDR IndexPage 5