The Daily Index — Thursday, February 5, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

VULNERABILITIES ALLOWED FULL COMPROMISE OF GOOGLE LOOKER INSTANCES

Tenable researchers uncovered LookOut, two flaws in Google Looker that allow attackers with developer rights to run remote code, steal secrets, and exfiltrate the internal MySQL database via an auth bypass and error-based SQL injection. Google patched cloud-hosted instances in September 2025, but self-hosted deployments must update, though no active exploitation has been detected.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

BIG BREACH OR SMOOTH SAILING? MEXICAN GOV'T FACES LEAK ALLEGATIONS

Hacktivist collective Chronus claims to have leaked 2.3TB of data from at least 25 Mexican government bodies, potentially exposing personal and healthcare records of 36 million citizens. Mexico's ATDT argues the dump repackages old breaches from obsolete third‑party systems, not fresh sensitive data.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

GATEWAYTOHEAVEN: FINDING A CROSS-TENANT VULNERABILITY IN GCP'S APIGEE

A cross-tenant vulnerability (CVE-2025-13292) discovered in Google Cloud's Apigee allowed attackers to chain SSRF via the GKE metadata endpoint, to escalate privileges via Dataflow JAR poisoning, and to abuse autoscaling to access analytics data across all Apigee tenants, including plaintext OAuth access tokens. The attack exploited shared cross-tenant metadata buckets lacking tenant-specific path isolation and overly permissive service account permissions within tenant projects. Organizations using managed multi-tenant cloud services should audit tenant isolation boundaries, restrict access to metadata endpoints from workloads, and ensure that shared infrastructure components enforce strict per-tenant scoping.

omeramiad.com · 11 min

TLDR InfoSec

BUILDING SECURITY TO UNLOCK ENGINEERING VELOCITY

Robinhood built SERA (Secure Enhanced Remote Approval), an internal platform that replaces VPN-dependent access approvals with passkey-based biometric authentication, enabling engineers to securely approve requests from any device. The system uses trusted enrollment on corporate devices to bootstrap credentials and then enables flexible remote approvals with tamper-evident audit trails, reducing approval times by over 20%. This approach demonstrates how organizations can reduce friction in security incident response and off-hours workflows without weakening authentication guarantees.

linkedin.com · 4 min

TLDR InfoSec

EXPLOITING AWS IAM EVENTUAL CONSISTENCY

AWS is a highly distributed system, which can lead to delays as changes propagate across the system. This is known as eventual consistency. This window can be exploited to recreate deleted or disabled AWS access keys within a nearly four-second window while the changes propagate. Disallow the principal from accessing via an SCP, wait 4 seconds, and then use the standard deletion process to prevent an attacker from exploiting eventual consistency. Other IAM operations, such as policy attachment and detachment, and role assumption, share this vulnerability.

offensai.com · 5 min

TLDR InfoSec

CLAUDE-CODE-TRANSCRIPTS

claude-code-transcripts is a Python CLI tool that converts Claude Code sessions into detailed, shareable HTML pages capturing prompts, tool calls, thinking traces, and commits. The tool supports both local Claude Code sessions and Claude Code for web via a reverse-engineered private API. It is useful for maintaining audit trails of AI-assisted development decisions and evaluating prompting strategies across coding agent workflows.

simonwillison.net · 4 min

TLDR InfoSec

ORION SECURITY (PRODUCT LAUNCH)

Orion provides an AI-driven data protection platform that maps how sensitive information moves across an organization, detects risky or abnormal data flows in real time, and automatically prevents leaks and insider-driven data loss across modern cloud environments.

orionsec.io

TLDR InfoSec

MOZILLA ANNOUNCES SWITCH TO DISABLE ALL FIREFOX AI FEATURES

Following user backlash, Mozilla announced that it will be adding a toggle to delay current and future AI features. Along with this toggle, there will be an AI control panel where users can selectively enable or disable specific features. Features will begin enabled in the AI control panel until users choose to disable them if they do not use the “Block AI Enhancements” toggle.

bleepingcomputer.com · 2 min

TLDR InfoSec

APPLE'S NEW IPHONE AND IPAD SECURITY FEATURE LIMITS CELL NETWORKS FROM COLLECTING PRECISE LOCATION DATA

Apple has announced a new feature for select iPhones and cellular-enabled iPads that limits the precision of location data shared with a customer's cell carrier. Applications that a user has granted precise location data and emergency calls will still have access to the user's precise location.

techcrunch.com · 2 min

TLDR InfoSec

NITROGEN RANSOMWARE IS SO BROKEN EVEN THE CROOKS CAN'T UNLOCK YOUR FILES

Ransomware gang Nitrogen shipped an ESXi encryptor with a fatal bug that corrupted its own Curve25519 public key, making decryption mathematically impossible even if victims pay. The slipup turns a profit-driven campaign into pure destruction: criminals earn nothing while organizations are left with unrecoverable hypervisors and costly rebuilds.

theregister.com · 2 min

TLDR InfoSec

STEP FINANCE SAYS COMPROMISED EXECS' DEVICES LED TO $40M CRYPTO THEFT

Solana-based DeFi platform Step Finance lost $40 million in digital assets after hackers compromised executives' devices and drained multiple treasury wallets.

bleepingcomputer.com · 2 min

TLDR InfoSec

SUDO MAINTAINER, HANDLING UTILITY FOR MORE THAN 30 YEARS, IS LOOKING FOR SUPPORT

Sudo's sole maintainer, Todd C. Miller, has been seeking sponsorship since losing corporate backing in February 2024, raising concerns about the long-term sustainability of a foundational Unix/Linux security utility.

theregister.com · 2 min

TLDR InfoSec

OPENCLAW'S AI ‘SKILL' EXTENSIONS ARE A SECURITY NIGHTMARE

Security researchers warn that OpenClaw's booming “skill” marketplace has become a major attack surface.

theverge.com · 2 min