TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 12 stories
  3. Page 3: TLDR AITLDR AI · 8 stories
  4. Page 4: TLDR DevTLDR Dev · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR ProductTLDR Product · 10 stories
  8. Page 8: TLDR DesignTLDR Design · 10 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 10 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Marketing · 12 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto, TLDR Product, TLDR Marketing · 13 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MANY BLUETOOTH DEVICES WITH GOOGLE FAST PAIR VULNERABLE TO WHISPERPAIR ATTACK

Belgian security experts have identified a new flaw in Bluetooth devices using Google's Fast Pair. This vulnerability enables attackers to take control of devices to manage audio, track location, or listen to microphone audio. The issue occurs because devices accept Fast Pair connections even outside pairing mode. An attacker can hijack a device in about 10 seconds from a distance of up to 14 meters.

arstechnica.com · 2 min

TLDR InfoSec

ALL YOUR OPENCODES BELONG TO US

OpenCode versions before v1.1.10 contained a critical RCE vulnerability via an unauthenticated HTTP server that exposed endpoints for arbitrary shell command execution, interactive terminal session creation, and arbitrary file reads. The vulnerability also enabled prompt injection into the LLM's context window, creating a secondary attack vector to manipulate the AI agent into exfiltrating data or performing malicious actions. Thousands of developers' machines were exposed with near-zero sandboxing, meaning agents had full access to SSH keys, cloud credentials, and browser cookies, with no audit trail of potential compromise.

johncodes.com · 7 min

TLDR InfoSec

SERVICENOW BODYSNATCHER FLAW HIGHLIGHTS RISKS OF RUSHED AI INTEGRATIONS

BodySnatcher is a critical vulnerability in ServiceNow's Now Assist AI Agents and Virtual Agent API that allows unauthenticated attackers to execute agentic workflows as any user by exploiting weak authentication defaults and auto-linking features—potentially creating backdoor admin accounts. ServiceNow patched hosted instances in late October (Now Assist AI Agents 5.1.18/5.2.19+ and Virtual Agent API 3.15.2/4.0.4+), but the underlying misconfigurations may persist in custom code and third-party integrations. Organizations should enforce MFA with proper validation scripts for Virtual Agent API providers, enable AI steward approval in AI Control Tower, and regularly audit and disable unused AI agents.

csoonline.com · 8 min

TLDR InfoSec

KUBERNETES V1.35: RESTRICTING EXECUTABLES INVOKED BY KUBECONFIGS VIA EXEC PLUGIN ALLOWLIST ADDED TO KUBERC

kubeconfigs can run any executable via the configured exec plugin, which is used to obtain credentials. Kubernetes v1.35 adds two new fields, credentialPluginPolicy and credentialPluginAllowlist, which can be used to restrict the executables that are available to kubectl for obtaining credentials. Currently, the only supported attribute for the allow list is `name` (for an executable name or path), but the SIG is looking to add further support, such as checksums, in the future.

kubernetes.io · 5 min

TLDR InfoSec

HOW A HACKING CAMPAIGN TARGETED HIGH-PROFILE GMAIL AND WHATSAPP USERS ACROSS THE MIDDLE EAST

TechCrunch has received a sample of a phishing link that is being sent to those connected to “Iran-related activities” from a UK-based Iranian activist. The initial contact is sent to the victim via WhatsApp and contains a phishing link that directs them to a malicious site that attempts to steal the victim's Gmail credentials, hijack the victim's WhatsApp account, monitor the victim's location, and capture audio and video. The attackers use the DuckDNS dynamic DNS provider to mask their links.

techcrunch.com · 5 min

TLDR InfoSec

AWS ENDS SSE-C ENCRYPTION, AND A RANSOMWARE VECTOR

AWS will end support for AWS SSE-C as an encryption option for S3, following its discovery in ransomware campaigns. SSE-C was a rarely used encryption method for S3 that allowed customers to supply an encryption key for use in S3 API requests. This was useful for ransomware operators because AWS never had access to the key, and it was quieter than alternative methods like KMS. Organizations can use KMS with customer-managed keys (CMK) or client-side encryption to replace the functionality.

cloudsecurityalliance.org · 3 min

TLDR InfoSec

BLINK AND YOU'LL MISS THEM: 6-DAY CERTIFICATES ARE HERE!

Let's Encrypt has made 6-day TLS certificates publicly available through its short-lived certificate profile, well ahead of the 2029 industry mandate that reduces maximum validity to 47 days. Google Trust Services also offers short-lived certificates with configurable validity periods as short as a single day. Organizations already using ACME clients for automation can adopt these shorter validity periods with minimal operational changes, since the increased renewal frequency is handled automatically.

scotthelme.co.uk · 3 min

TLDR InfoSec

INGRAM MICRO ADMITS SUMMER RANSOMWARE RAID EXPOSED THOUSANDS OF STAFF RECORDS

Ingram Micro disclosed that the SafePay ransomware group's July 2025 attack compromised the personal data of 42,521 employees and job applicants, including names, identity document numbers (passports, driver's licenses, and SSNs), and employment evaluations. The attackers claimed to have stolen 3.5 TB of data, and the incident forced system shutdowns that prevented MSPs from managing customer services and sent some regional staff home. Customers criticized the distributor's poor communication during the incident, with some unable to locate attack updates without external assistance.

theregister.com · 2 min

TLDR IndexPage 5