TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR InfoSec, TLDR, TLDR AI · 9 stories
  2. Page 2: TLDR InfoSecTLDR InfoSec · 9 stories
  3. Page 3: TLDRTLDR · 11 stories
  4. Page 4: TLDR AITLDR AI · 11 stories
  5. Page 5: TLDR ProductTLDR Product · 11 stories
  6. Page 6: TLDR DesignTLDR Design · 11 stories
  7. Page 7: TLDR MarketingTLDR Marketing · 12 stories
  8. Page 8: Resources & ToolsTLDR, TLDR AI, TLDR InfoSec, TLDR Design · 9 stories
  9. Page 9: SponsoredTLDR, TLDR AI, TLDR InfoSec, TLDR Product, TLDR Marketing · 6 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 2

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

A-LIST DIRECTORS, ACTORS, AND CELEBRITIES EXPOSED IN MAJOR FILM FESTIVAL BREACH

Security researcher Jeremiah Fowler found an unencrypted, unsecured database linked to the Tribeca Film Festival. This database contained a backup with over 163,000 users, 15,000 film contacts, and 13,500 other contacts. It also included data on numerous celebrities from the entertainment industry, such as email addresses, names, Facebook locations, addresses, IP addresses, newsletter information, and bcrypt password hashes.

expressvpn.com · 3 min

TLDR InfoSec

THE PRIVILEGED ROLES NOBODY TALKS ABOUT

MDM administrator roles are as important as Domain Admin, if not more so, as they can deploy arbitrary scripts, push configuration profiles, issue remote wipes, manage applications, manage certificates and authentication configurations, and modify compliance policies. Unfortunately, many organizations do not have sufficient controls in place for these roles, with lax policies such as not having dedicated accounts or workstations, no just-in-time privilege elevation or multi-admin approvals, and overly permissive Graph API access. This article includes suggestions to remediate these issues, such as fixing the above issues, locking down script and policy deployment, hardening device enrollment, and implementing additional alerting on high-risk activities.

trustedsec.com · 8 min

TLDR InfoSec

WHAT HAPPENED AFTER WE PUSHED OUR .ENV TO A PUBLIC REPO

Tachyon's committed canary .env files containing AWS, Anthropic, and Postgres credentials were made public on GitHub. GitHub flagged secrets within seconds without email alerts. AWS attached AWSCompromisedKeyQuarantineV3 shortly after a push, and within about five minutes, credentials connected externally. The quarantine policy didn't revoke keys or block secret commands, allowing an attacker using TruffleHog and Boto3 to access Secrets Manager and retrieve credentials seven minutes after pushing. Other traffic came from OVH, Tor exit, and Gigahost addresses, logging into Postgres and reading decoy tables. The intrusion stopped there, as the harvested secrets remained unused during the observation. Logs don't reveal if an LLM helped triage, leaving uncertainty about whether it was an attacker or defensive scan.

tachyon.so · 5 min

TLDR InfoSec

UK AISI/CAISI PRELIMINARY ASSESSMENT OF KIMI K3'S CYBER CAPABILITIES

UK AISI and CAISI jointly evaluated Moonshot AI's Kimi K3, released July 16 and slated for open-weight release by July 27, and placed it well behind frontier US models while ahead of GLM-5.2, scoring 32% on Carnegie Mellon's ExploitBench against 76.2% for top US models and 24.4% for GLM-5.2, and reaching step 17 of the 32-step "The Last Ones" cyber range against 28.5 steps for the leading US models. The gap narrows unevenly because Kimi K3 matched the frontier on coverage and came close on bug reproduction but achieved arbitrary code execution on zero of 41 samples where top models managed 20, and yet it completed the full cyber range once in ten attempts, which the evaluators read as autonomous capability against small, weakly defended enterprise networks given initial access. Two framing points deserve weight, the first being that Kimi K3's safeguards did not stop it from attempting exploit development or offensive operations at all, and the second being that US closed-weight comparators ran with system-level safeguards disabled to measure maximum capability, so the published gap measures raw model ability rather than what a user encounters, a distinction that matters as open-weight releases from PRC labs keep closing the trendline.

nist.gov · 4 min

TLDR InfoSec

SHAREDROOT; ESCAPING THE CLAUDE COWORK SANDBOX

A Claude Cowork session on macOS can chain a user-namespace feature, a Linux traffic-control module, and a recent kernel bug to escalate from an unprivileged VM user to guest root and then write directly to the host filesystem via a shared / mount. The write primitive comes from CVE-2026-46331 in act_pedit, and the path persists as similar bugs appear. To harden the environment, disable unprivileged user namespaces, tighten seccomp, block unneeded autoloaded modules and helper binaries, and scope or remove the host filesystem share so guest-root cannot touch SSH keys or other sensitive data.

accomplish.ai · 8 min

TLDR IndexPage 2