TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 12 stories
  3. Page 3: TLDR AITLDR AI · 13 stories
  4. Page 4: TLDR DevTLDR Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 11 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 12 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 13 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GRUBHUB CONFIRMS HACKERS STOLE DATA IN RECENT BREACH

Grubhub has confirmed that an unarmed threat actor accessed its systems and stole data. While Grubhub has not confirmed the identity of the threat actor, sources have reported that the ShinyHunters group is extorting the company. The threat actor is reportedly extorting the company to prevent the leak of data from an older Salesforce instance and to prevent the theft of data from the company's current Zendesk platform.

bleepingcomputer.com · 2 min

TLDR InfoSec

HOW A HACKING CAMPAIGN TARGETED HIGH-PROFILE GMAIL AND WHATSAPP USERS ACROSS THE MIDDLE EAST

A phishing campaign delivered via WhatsApp targeted Iranian activists, academics, government officials, and business leaders across the Middle East, stealing Gmail credentials with 2FA codes, hijacking WhatsApp accounts via malicious QR codes, and attempting to exfiltrate location data, photos, and audio recordings. An exposed attacker server revealed 850+ records affecting fewer than 50 confirmed victims, with infrastructure registered as early as August 2025 using DuckDNS for domain masking. Security researchers noted hallmarks consistent with IRGC-linked spearphishing, though financial motivations have not been ruled out. Users should avoid clicking unsolicited WhatsApp links and regularly audit linked devices.

techcrunch.com · 9 min

TLDR InfoSec

HOW THREAT ACTORS ARE USING SELF-HOSTED GITHUB ACTIONS RUNNERS AS BACKDOORS

The Shai-Hulud worm demonstrated how attackers weaponize self-hosted GitHub Actions runners as persistent backdoors by installing rogue runners on compromised machines and using GitHub Discussions as a command-and-control channel via intentionally vulnerable workflows with command injection. The technique exploited the RUNNER_TRACKING_ID=0 environment variable to bypass process cleanup and achieve persistence, while all traffic flowed to github.com, evading traditional network defenses. Security teams should audit runner inventories for unauthorized registrations, implement ephemeral runners, restrict self-hosted runners to private repositories only, and deploy runtime detection for persistence techniques.

sysdig.com · 10 min

TLDR InfoSec

NPM TO IMPLEMENT STAGED PUBLISHING AFTER TURBULENT SHIFT OFF CLASSIC TOKENS

npm has announced a new release strategy called staged publishing to protect against future compromises in the wake of 2025's Shai-Hulud supply chain compromises. Staged publishing will complement npm's previous credentials safety efforts by requiring new project releases to be manually approved via an MFA-verified maintainer. Package maintainers have expressed a need for more registry-level protections after npm's chaotic removal of classic tokens.

links.tldrnewsletter.com · 10 min

TLDR InfoSec

ACCOUNT TAKEOVER IN FACEBOOK MOBILE APP DUE TO USAGE OF CRYPTOGRAPHICALLY UNSECURE RANDOM NUMBER GENERATOR AND XSS IN FACEBOOK JS SDK

A security researcher chained multiple vulnerabilities in Facebook's JavaScript SDK to achieve account takeover in the Facebook mobile app, exploiting Math.random() for callback identifier generation, DOM XSS via unsanitized SVG injection in the Customer Chat plugin, and X-Frame-Options bypass in mobile webviews. The attack reconstructed the PRNG state by forcing plugin iframe reinitializations and observing leaked window.name values, enabling prediction of security-critical callback identifiers. Meta awarded a $66,000 bounty and fixed the vulnerability in December 2023.

ysamm.com · 10 min

TLDR IndexPage 5