TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR InfoSec, TLDR Design, TLDR IT, TLDR AI, TLDR Fintech · 9 stories
  2. Page 2: TLDRTLDR · 11 stories
  3. Page 3: TLDR InfoSecTLDR InfoSec · 13 stories
  4. Page 4: TLDR DesignTLDR Design · 10 stories
  5. Page 5: TLDR ITTLDR IT · 12 stories
  6. Page 6: TLDR AITLDR AI · 8 stories
  7. Page 7: TLDR AI — continuedTLDR AI · 8 stories
  8. Page 8: TLDR DevTLDR Dev · 12 stories
  9. Page 9: TLDR CryptoTLDR Crypto · 12 stories
  10. Page 10: TLDR MarketingTLDR Marketing · 12 stories
  11. Page 11: TLDR DataTLDR Data · 12 stories
  12. Page 12: TLDR FintechTLDR Fintech · 15 stories
  13. Page 13: Resources & ToolsTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Data · 10 stories
  14. Page 14: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Fintech · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 3

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

77 OPEN VSX EXTENSIONS FOUND HARVESTING DEVELOPER INFO

Manifold Security uncovered an "evil twin" campaign on the Open VSX registry involving 77 malicious extensions that impersonated legitimate packages to harvest developer environment data. While claiming to only collect anonymous metrics, the most aggressive variants actively exfiltrated OS usernames, workspace paths, Git commit hashes, and CI/CD infrastructure details to mangorbit[.]com, utilizing DNS TXT lookups for C2 resilience. Although Open VSX removed the packages on August 3, security teams should block the C2 domain and manually audit developer environments for the malicious extension IDs.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

HARDWARE HACKING: FROM ZERO TO A PRE-AUTH STACK BUFFER OVERFLOW ON AMAZON'S BEST-SELLING ROUTER

Researcher Rotce rooted the Mercusys MB115-4G, Amazon Spain's best-selling router, via UART and traced a pre-auth path in /usr/bin/httpd where http_gdpr_decrypt copied up to 2048 bytes of AES-decrypted, attacker-controlled data into a 512-byte caller buffer with no bounds check, tracked as CVE-2026-12495. The bug was surfaced through disciplined static analysis rather than a working exploit, following the routing table into the login handler in Ghidra and confirming with Ghidriff that the flaw persisted unpatched from v1.7.0 through v1.9.0. Mercusys' own validation reproduced the crash and shipped a fix in v1.11.0 that added the missing bounds check, moved the login decrypt path from RSA to ECC, and introduced HMAC verification.

rotcee.github.io · 16 min

TLDR InfoSec

PHISHING SERVICE SPOOFS RINGCENTRAL TO STEAL MICROSOFT 365 ACCOUNTS

The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

AGENTIC INCIDENT RESPONSE NOTEBOOKS

The DNB Cyber Defense Center's incident response team used marimo to build out incident response workflows as modular notebooks. The team developed a custom SDK for cross-platform query translation across Splunk, Defender, and SQL interfaces while utilizing marimo's native cell dependencies and caching capabilities. The marimo-pair agentic interface also allows agents to create and execute the same notebooks as human responders.

blog.cauchy.org · 6 min

TLDR InfoSec

HEVD: FROM STACK OVERFLOWS TO MODERN POOL GROOMING

This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.

sibouzitoun.tech · 1 min

TLDR InfoSec

NEW PASS-TA-KEY ATTACKS LET MALWARE HIJACK GOOGLE-SYNCED PASSKEYS

Palo Alto Networks' Unit 42 has released details of three new attack techniques, which it calls Pass-ta-key, that an attacker with access to a TPM-equipped Windows device can use to abuse Google Password Manager's synced passkeys to steal passkeys. The first technique allows the attacker to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. If a site checks the User Verified flag of the response, the authentication can fail. The other two attack techniques go further by allowing the attacker to register their own user-verification key or even obtain the master key, which is used to encrypt all passkeys synced through the victim's Google Password Manager.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CANADIAN MAN PLEADS GUILTY TO HACKING US CLOUD STORAGE PROVIDER AND EXTORTING ITS CUSTOMERS FOR MILLIONS

Connor Riley Moucka pleaded guilty to multiple federal charges after using stolen credentials to breach over 165 SaaS customers between February and October 2024. The campaign compromised billions of records across more than 100 million individuals and caused roughly $9.5 million in corporate damages. Moucka successfully extorted over $2.5 million from his victims and now faces up to 30 years in federal prison at his upcoming October sentencing.

databreaches.net · 2 min

TLDR IndexPage 3