TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR DevTLDR Dev · 11 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 11 stories
  8. Page 8: TLDR FoundersTLDR Founders · 13 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 8 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 12 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

AI-ASSISTED THREAT ACTOR COMPROMISES 600+ FORTIGATE DEVICES IN 55 COUNTRIES

A Russian-speaking, financially motivated threat actor leveraged commercial generative AI tools to compromise over 600 FortiGate devices across 55 countries by targeting exposed management interfaces and weak single-factor credentials, according to Amazon Threat Intelligence. Post-exploitation activity included Active Directory compromise, credential harvesting via pass-the-hash/pass-the-ticket and NTLM relay attacks, and targeting Veeam Backup servers using CVE-2023-27532 and CVE-2024-40711, consistent with pre-ransomware operations. Organizations should immediately restrict exposure of the FortiGate management interface, enforce MFA for all administrative and VPN access, rotate SSL-VPN credentials, and isolate backup infrastructure from general network access.

thehackernews.com · 4 min

TLDR InfoSec

ATTACKERS HAVE 16-DIGIT CARD NUMBERS, EXPIRY DATES, BUT NOT NAMES. NOW ORG GETS £500K FINE

The UK Court of Appeal has backed the ICO's £500k fine on DSG Retail over a 2017 breach that exposed 5.6 million card details and data on 14 million people, even though attackers lacked cardholder names. The ruling confirms that payment card numbers and expiry dates are personal data from the controller's perspective, stresses jigsaw identification risk, and strengthens regulators' ability to penalize weak security in future cyberattacks.

theregister.com · 3 min

TLDR InfoSec

AI IN THE MIDDLE: TURNING WEB-BASED AI SERVICES INTO C2 PROXIES & THE FUTURE OF AI-DRIVEN ATTACKS

AI assistants with web-browsing capabilities, specifically Grok and Microsoft Copilot, can be abused as covert C2 relays by using anonymous web access to fetch attacker-controlled URLs and return embedded commands, all without API keys or registered accounts. This PoC uses a WebView2-based C++ implant to create a bidirectional channel in which victim data is exfiltrated via URL query parameters and commands are returned via AI-generated responses, with simple encoding sufficient to bypass model-side safeguards. The research outlines a near-term evolution toward AI-Driven malware where implants shift from static logic to prompt-driven behavior, enabling AI-assisted anti-sandbox detection, intelligent victim triage, and targeted ransomware that prioritizes high-value files to evade volume-based detection thresholds.

research.checkpoint.com · 9 min

TLDR InfoSec

TESTING ACCESS TO AWS RESOURCES WITHOUT ANGERING THE PEOPLE THAT PAY THE BILLS

This post details a methodology for empirically verifying AWS resource exposure without reading sensitive data or altering the resource state. It employs four techniques: comparing unsigned and signed requests, conducting metadata-only reads, performing no-op operations like untagging nonexistent keys, and sending malformed request probes that leverage AWS' sequence where authorization checks occur before parameter validation. The "3-topic method" ensures probe safety by testing identical changes across allowed, denied, and nonexistent resources — if only denied and nonexistent targets return 403 errors and allowed ones return 400, it confirms authorization without executing the action. This method is implemented in the open-source sns-buster tool for SNS and is adaptable to other AWS services for CSPM, bug bounty, and IAM policy validation.

plerion.com · 10 min

TLDR InfoSec

EBPF RING BUFFER VS PERF BUFFER

Ring buffer, introduced in Linux 5.8, replaced the legacy perf buffer as the recommended mechanism for kernel-to-userspace data transfer in eBPF programs. It uses a single shared circular buffer across all CPUs instead of per-CPU buffers, eliminating cross-CPU event ordering complexity and reducing copy overhead. This article walks through both implementations in C and Go using cilium/ebpf, demonstrating how the ring buffer's reserve-and-submit model via bpf_ringbuf_reserve and bpf_ringbuf_submit provides a simpler, higher-throughput path compared to perf buffer's bpf_perf_event_output approach. For security tooling built on eBPF tracing, the ring buffer is now the default choice for structured event streaming from kernel-level monitors to usersp.

kubefront.net · 4 min

TLDR InfoSec

ANTHROPIC LAUNCHES CLAUDE CODE SECURITY FOR AI-POWERED VULNERABILITY SCANNING

Anthropic launched Claude Code Security in limited research preview for Enterprise and Team customers, offering AI-powered codebase vulnerability scanning that goes beyond static analysis by reasoning about component interactions and tracing data flows. Findings undergo a multi-stage verification process to filter false positives, with each vulnerability assigned a severity and confidence rating alongside suggested patches. The feature employs a human-in-the-loop approach where developers review and approve all remediation before any changes are applied.

thehackernews.com · 2 min

TLDR InfoSec

CLOUDFLARE OUTAGE ON FEBRUARY 20, 2026

Cloudflare experienced a 6-hour outage after a cleanup sub-task in its Addressing API queried with an empty `pending_delete` parameter, causing the system to interpret all 4,306 BYOIP prefixes as queued for deletion and systematically withdrawing ~1,100 BGP prefixes across customer networks. The bug rendered services including Magic Transit, Spectrum, and a subset of 1.1.1.1 unreachable. Recovery was complicated by varying states of impact, where some customers lost both prefix advertisements and service bindings. Cloudflare is implementing circuit breakers for large-scale BGP withdrawal actions, separating operational and configured state in the Addressing API, and deploying health-mediated configuration snapshots as part of their Code Orange: Fail Small initiative.

blog.cloudflare.com · 11 min

TLDR InfoSec

FBI SAYS ATM ‘JACKPOTTING' ATTACKS ARE ON THE RISE, AND NETTING HACKERS MILLIONS IN STOLEN CASH

ATM jackpotting, first showcased by researcher Barnaby Jack, has become a lucrative cybercrime, with over 700 attacks in 2025 netting at least $20 million in cash. Criminals use physical access, generic keys, and Ploutus malware to hijack Windows-based ATMs via XFS software, directly commanding dispensers to spew banknotes without touching customer accounts and often evading detection until long after cash-out.

techcrunch.com · 2 min

TLDR IndexPage 5