TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 10 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR DevTLDR Dev · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 11 stories
  8. Page 8: TLDR FoundersTLDR Founders · 11 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 12 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 12 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto, TLDR Founders, TLDR Marketing · 11 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

NETSUPPORT MANAGER 0-DAY VULNERABILITIES ENABLE REMOTE CODE EXECUTION

Two critical vulnerabilities in NetSupport Manager (CVE-2025-34164 and CVE-2025-34165) can be chained to achieve unauthenticated remote code execution through the software's undocumented broadcast feature, which operates on TCP port 5405 without requiring authentication. The flaws—a heap-based out-of-bounds write and a stack-based out-of-bounds read—enable attackers to bypass ASLR, perform arbitrary memory writes, and gain remote shell access, posing a significant risk to Operational Technology (OT) environments where the software is commonly deployed. Organizations should upgrade to version 14.12.0000 or later and restrict access to port 5405 as an interim mitigation.

gbhackers.com · 3 min

TLDR InfoSec

CANVA AMONG ~100 TARGETS OF SHINYHUNTERS OKTA IDENTITY-THEFT CAMPAIGN

ShinyHunters is running an Okta single sign-on credential-stealing campaign against roughly 100 high-value organizations, including Canva, Atlassian, RingCentral, and others. The group uses evolved voice phishing to capture SSO logins, enroll its own devices in MFA, pivot into SaaS apps, exfiltrate data, and then extort victims. There is no confirmation of which named firms were successfully breached.

theregister.com · 3 min

TLDR InfoSec

WHO OPERATES THE BADBOX 2.0 BOTNET?

A leaked screenshot from Kimwolf botnet operators revealed they had compromised the Badbox 2.0 control panel, exposing seven authorized user email addresses that OSINT investigation traced to Chen Daihai and Zhu Zhiyu of Beijing Astrolink Wireless Digital Technology—individuals whose domains were previously flagged in HUMAN Security's Badbox 2.0 report. The investigation used password reuse across breach databases, domain registration records, and social media pivots to connect qq.com email addresses to multiple Chinese technology companies distributing pre-infected Android TV boxes. This unauthorized access allows Kimwolf to bypass residential proxy mitigations by loading malware directly onto Badbox 2.0's 10+ million compromised devices.

krebsonsecurity.com · 8 min

TLDR InfoSec

HOW TO ENCRYPT YOUR PC'S DISK WITHOUT GIVING THE KEYS TO MICROSOFT

BitLocker encrypts Windows PCs to protect data, but many systems automatically store recovery keys with Microsoft when users sign in with a Microsoft account, creating a potential privacy risk if authorities obtain those keys. By upgrading to Windows 11 Pro, users can fully control BitLocker, decrypt any existing Microsoft-managed setup, and re-encrypt the drive while saving the recovery key locally, such as on paper or an external drive, rather than in the cloud.

arstechnica.com · 8 min

TLDR InfoSec

LLM KEY SERVER: PROVIDING SECURE AND CONVENIENT ACCESS TO INTERNAL LLM APIS

Mercari's AI Security team developed a key server to address the challenge of managing API key-based access to LLMs. The key server uses Google Workspace and Google Cloud for OIDC authentication to LiteLLM, which provides time-limited API access to various models through a unified API. The team also developed an internal CLI, GitHub Action, and Google Apps Script template to support adoption of the LLM key server.

engineering.mercari.com · 5 min

TLDR InfoSec

WHY HAS MICROSOFT BEEN ROUTING EXAMPLE.COM TRAFFIC TO A COMPANY IN JAPAN?

Microsoft's autodiscover service was found routing email traffic for example.com—a domain reserved for testing under RFC2606—to subdomains belonging to Sumitomo Electric in Japan, potentially causing test credentials to be sent outside Microsoft's network. The misconfiguration, which may have persisted for five years, has been suppressed, but Microsoft has not explained how the Japanese company's servers were added to its network configuration. The incident raises concerns about other potential misconfigurations following Microsoft's 2024 breach, where forgotten test account privileges enabled Russian state hackers to monitor executive emails.

arstechnica.com · 3 min

TLDR InfoSec

BROWSER-BASED ATTACKS HIT 95% OF ENTERPRISES — AND TRADITIONAL SECURITY TOOLS NEVER SAW THEM COMING

95% of organizations experienced browser-based attacks last year that evaded traditional security tools. Attackers operated inside trusted sessions where web gateways, cloud access brokers, and endpoint protection lose visibility after login. Recent incidents, including ShadyPanda's weaponized extensions and Cyberhaven's supply chain compromise, demonstrate how attackers exploit browser auto-updates and session tokens rather than zero-days. Security leaders recommend inventorying extensions, implementing 48-72 hour auto-update delays, and moving data protection to the browser layer, where 64% of encrypted traffic currently goes uninspected.

venturebeat.com · 8 min

TLDR IndexPage 5