TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR InfoSec, TLDR Dev, TLDR Crypto, TLDR IT, TLDR AI · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR — continuedTLDR · 8 stories
  4. Page 4: TLDR InfoSecTLDR InfoSec · 12 stories
  5. Page 5: TLDR DevTLDR Dev · 10 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR ITTLDR IT · 12 stories
  8. Page 8: TLDR AITLDR AI · 9 stories
  9. Page 9: TLDR AI — continuedTLDR AI · 9 stories
  10. Page 10: TLDR DesignTLDR Design · 12 stories
  11. Page 11: TLDR MarketingTLDR Marketing · 13 stories
  12. Page 12: TLDR DataTLDR Data · 15 stories
  13. Page 13: TLDR FintechTLDR Fintech · 14 stories
  14. Page 14: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design · 7 stories
  15. Page 15: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto, TLDR Design, TLDR Marketing, TLDR Data, TLDR Fintech · 18 stories
  16. Page 16: Sponsored — continuedTLDR Fintech, TLDR IT · 2 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 4

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CHINESE HACKERS EXPLOIT CRITICAL TENCENT SOFTWARE FLAW FOR ONE-CLICK CODE EXECUTION

China-linked UNC3569 used a single crafted link to gain system-level code execution through Sogou Input Method, Tencent's Chinese-language keyboard app used by hundreds of millions of Windows users, and deployed its GrayRabbit backdoor. Gen Threat Labs found that CVE-2026-51990 chained argument injection in the sgbiz protocol handler with a bundled Chromium 80 browser that was six years out of date, ran without a sandbox, and dropped same-origin protections. Tencent patched the injection bug in version 16.3.0.3498, but the outdated Chromium engine behind the chain remained unchanged as of September 10.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

TEXAS UTILITY CENTERPOINT ENERGY CONFIRMS DATA BREACH AFTER HACKER CLAIMS 7.49M RECORDS STOLEN

CenterPoint Energy confirmed an attacker pulled customer data through an external-facing API on September 12. A hacker using the alias "4d722e4d656f77" claims 7.49 million records, including names, phone numbers, billing addresses, account numbers, payment status, and partial Social Security numbers. The attacker says the API lacked WAF protection, rate limiting, and JWT/auth tokens, and stopped only after a CAPTCHA was added.

securityaffairs.com · 3 min

TLDR InfoSec

THE £3 WIFI EXTENDER WITH A BACKDOOR IN EVERY UNIT

A £3 Z05L WiFi extender uses an MT7620 chip and a four-megabyte Winbond flash. Its firmware starts Telnet on every boot with root password 198277tt@, and the web API accepts requests without session checks, so a mac parameter can reach system() without validation, allowing root command injection. Firmware updates verify CRC32 values only, allowing forged images, and the firewall leaves inbound services exposed on bridged networks as the config partition stores WiFi credentials in plaintext.

affixsec.substack.com · 13 min

TLDR InfoSec

PARASHELLS: PARALLELS DESKTOP TURNS APPLIANCE INSTALL INTO A ROOT SHELL

CVE-2026-90894 lets a non-admin macOS user gain root through Parallels Desktop's appliance installer. JFrog tested Desktop 26.4.0 build 57513 on Apple Silicon. The root daemon exposes a world-writable Unix socket where an unsigned local process can authenticate through PrlSrv_LoginLocal. A quote in sVmParentPath injects tar's --use-compress-program option, and tar then launches an attacker script as root. Parallels released version 27.0.0 on September 1 to fix this issue.

jfrog.com · 9 min

TLDR InfoSec

ENTRUST TURNS CRYPTOGRAPHIC INVENTORY DATA INTO SECURITY ACTION

Entrust added Cryptographic Bill of Materials (CBOM) import and export to its Cryptographic Security Platform, so teams can map which systems depend on weak or noncompliant keys and certificates and fix the riskiest first. The update also brings Ansible-based certificate automation, composite algorithms for phased post-quantum migration, and SPIRE support for AI agent and workload identities. The platform now runs as a service or on-premises, which matters as DORA, NIS2, and the recent US Executive Order push for CBOM-based inventories.

helpnetsecurity.com · 3 min

TLDR InfoSec

ACTIVE EXPLOITATION ATTEMPTS TARGET WSO2 API MANAGER JWT BYPASS WITH FORGED ADMIN TOKENS

WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.

thehackernews.com · 2 min

TLDR InfoSec

REVERSE-ENGINEERING FIND MY PEOPLE TO STALK MY EX A FRIEND, CAUSE I CAN

An in-depth guide to how the author decided to reverse-engineer Apple's Find My system to register a Linux device and (consensually) track a friend. The author first started by attempting to use the iCloud web API but quickly discovered that it didn't support Find My. After reversing and fuzzing the flow, the author was able to reproduce the process by: authenticating to Apple's private service, registering the Linux machine as an IDS client, receiving the existing Find My share key, and using it to fetch and decrypt the friend's latest location.

zerotistic.blog · 21 min

TLDR IndexPage 4