TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 12 stories
  4. Page 4: TLDR DevTLDR Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 11 stories
  8. Page 8: TLDR MarketingTLDR Marketing · 12 stories
  9. Page 9: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design · 9 stories
  10. Page 10: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Marketing · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SYNOLOGY DSM 7.3.2

A local privilege escalation vulnerability chain in Synology DSM 7.3.2-86009 allows any authenticated user with shell access to gain root when DownloadStation with BitTorrent is enabled. The exploit chains three misconfigurations: a world-writable Transmission RPC socket running as root, a world-writable /volume1/@eaDir/ system directory, and a missing nosuid mount flag on /volume1, enabling attackers to configure Transmission's script-torrent-done-filename to execute arbitrary payloads as root upon torrent completion. A full PoC is available, and the vulnerability has been reported to Synology PSIRT.

thecontractor.io · 10 min

TLDR InfoSec

KONNI HACKERS TARGET BLOCKCHAIN ENGINEERS WITH AI-BUILT MALWARE

Researchers from CheckPoint have discovered a new malicious campaign from the North Korean Konni hackers. The attack begins with a Discord link that downloads a zip archive containing a lure document and two batch files which downloads a PowerShell backdoor and then deletes other signs of infection. Notably, the malware contains signs of it being AI-generated, such as comments with variable placeholders.

bleepingcomputer.com · 2 min

TLDR InfoSec

ORGANIZED TRAFFER GANG ON THE RISE TARGETING WEB3 EMPLOYEES AND CRYPTO HOLDERS

Hybrid Analysis uncovered a sophisticated Russian-speaking Traffer operation targeting cryptocurrency users and Web3 employees through fake Electron applications disguised as AI productivity tools, meeting software, and gaming platforms, with documented earnings of at least $2.4 million. The campaign uses 80+ domains, elaborate fake company ecosystems with purchased social media accounts, and abused code-signing certificates to deliver second-stage payloads, with shared infrastructure suggesting links to the Marko Polo, CrazyEvil, and Wagmi Traffer groups. Security teams should monitor for the provided IOCs and exercise caution with unsolicited software downloads from Web3-themed applications, particularly those requiring invitation codes or tokens for access.

hybrid-analysis.blogspot.com · 18 min

TLDR InfoSec

EXPLOITING KEYSPACE REDUCTION AND RELAY ATTACKS IN 3DES AND AES-PROTECTED NFC TECHNOLOGIES

Modern NFC cards used in hotel keys, tickets, and access systems can be attacked not by breaking 3DES or AES, but by abusing how keys and memory are handled after authentication. By relaying the legit reader–card handshake and then partially overwriting key bytes, attackers can shrink the effective keyspace from astronomically large to something brute‑forceable with modest hardware. Weak or missing integrity checks, non‑atomic key writes, and flawed non‑NXP clone cards make it possible to recover full keys from one or a few tags, sometimes in under a minute. Proper key diversification, locking key pages, enabling CMAC/secure messaging, and migrating to stronger platforms like DESFire EV3 sharply reduce these risks.

breakmeifyoucan.com · 10 min

TLDR InfoSec

149M LOGINS FROM ROBLOX, TIKTOK, NETFLIX, CRYPTO WALLETS FOUND ONLINE

A security researcher discovered a 96GB database containing 149 million stolen credentials for services including Facebook (17M), Netflix (3.4M), Binance (420K), Gmail (48M), and government domains from multiple countries, exposed online without authentication. The data appeared to be collected via infostealer malware through an organized system with reversed labeling to sort by device and website. The database was actively growing during the month it took to get the hosting provider to take it offline. Users should enable MFA, use unique passwords via password managers, and monitor for credential exposure on services like Have I Been Pwned.

hackread.com · 3 min

TLDR InfoSec

MALICIOUS VS CODE AI EXTENSIONS WITH 1.5 MILLION INSTALLS STEAL DEVELOPER SOURCE CODE

Security firm Koi Security uncovered two popular AI-branded VS Code extensions that quietly exfiltrate every opened and edited file to China-based servers, while still functioning as legitimate coding assistants. They also support remote-triggered bulk exfiltration of up to 50 workspace files, fingerprint devices via embedded analytics SDKs, and are linked to a broader “MaliciousCorgi” campaign alongside new PackageGate flaws in JavaScript package managers that weaken common supply chain defenses.

thehackernews.com · 4 min

TLDR IndexPage 5