TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR InfoSec, TLDR IT, TLDR Crypto, TLDR Dev · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR — continuedTLDR · 8 stories
  4. Page 4: TLDR AITLDR AI · 11 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR ITTLDR IT · 10 stories
  7. Page 7: TLDR CryptoTLDR Crypto · 11 stories
  8. Page 8: TLDR DevTLDR Dev · 11 stories
  9. Page 9: TLDR ProductTLDR Product · 11 stories
  10. Page 10: TLDR DesignTLDR Design · 9 stories
  11. Page 11: TLDR MarketingTLDR Marketing · 13 stories
  12. Page 12: Resources & ToolsTLDR Dev, TLDR InfoSec, TLDR Design · 7 stories
  13. Page 13: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Product, TLDR Design, TLDR Marketing, TLDR IT · 17 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

POLINRIDER IS A/B TESTING ITS WAY PAST YOUR DETECTIONS

DPRK's PolinRider malware spread through GitHub organizations by force-pushing rewritten commits from infected developers' machines, planting VS Code folderOpen tasks that run an obfuscated JavaScript payload disguised as fa-solid-400/500/900.woff2 and, since September 28, fa-solid-300.llf. OpenSourceMalware traced 853 force-pushes across three Binary-Mindz repos and found variants with different paths, obfuscators, and C2-reported build markers running in parallel, which it reads as deliberate A/B testing, while copied author dates and reused commit messages quietly reverted three cleanup attempts. Defenders should flag fake fonts by file content rather than name, scan every branch through bare clones, audit force-push activity logs, and enforce force-push blocking and signed commits on all branches.

opensourcemalware.com · 11 min

TLDR InfoSec

FROM EXPOSURE TO LOCKDOWN: HOW AWS NEUTRALIZES COMPROMISED IAM CREDENTIALS THROUGH MANAGED POLICIES

AWS automatically attaches the AWSCompromisedKeyQuarantineV3 managed policy to an exposed IAM user within 10 seconds of a public GitHub push, with the CloudTrail AttachUserPolicy event misleadingly attributed to the victim's IAM user rather than to AWS automation. Each policy version tracked real-world attack evolution, with permissions added to block Lambda-based cryptomining, S3 data deletion for extortion, and Bedrock API abuse after Permiso's research exposed unauthorized InvokeModel calls. Security teams should alert on unexpected AttachUserPolicy events in CloudTrail, treat the quarantine event as confirmation of active key exposure rather than as resolution, and rotate all affected credentials before removing the policy.

unit42.paloaltonetworks.com · 15 min

TLDR InfoSec

SENDER SPOOFING IN PROTON MAIL VIA DISPLAY-NAME HOMOGRAPH

Proton Mail's web interface can show a forged sender that looks identical to a real one. The attacker sets a display name containing an address-shaped string like sundar@gmaiI[.]com where the capital I matches lowercase l in the default UI font. Messages from domains without DMARC arrive in the inbox with no authentication banner, even when SPF fails. A Reply-To header can route responses to an attacker's address without showing it unless the user expands headers, and the spoofed sender also appears unchanged in macOS desktop notifications, outside the app interface. The issue was reported in February 2025, confirmed and bounty-awarded in April 2025, and can still be reproduced as of September 2026.

alonsovidales.github.io · 3 min

TLDR InfoSec

GOOGLE TO CRITICAL INFRA ORGS: OUR AI SCANNERS WON'T BE EVIL, PROMISE

Google and Wiz launched Scan for Good using Gemini 3.8 Flash Cyber and Red Agent with authorized scans targeting public websites, APIs, and applications, while human researchers validate findings and handle disclosure. Red Agent found a GitHub Actions injection flaw in Snowflake's connector, allowing command execution. Other cases exposed 8.8 million files, hospital systems, elderly residents' data, and railway administrator sessions.

theregister.com · 3 min

TLDR InfoSec

HOUSE OF APPLE 2 ON MODERN GLIBC

This walkthrough breaks down House of Apple 2, a glibc FSOP technique that bypasses the vtable validation added in newer glibc. It points a FILE structure's vtable to legitimate wide-character stream code, which then dispatches to a second vtable that glibc does not range-check. Step by step in GDB, the author turns that unchecked indirect call into an arbitrary call, pivots the stack, and runs a ROP chain to a shell. The technique still works cleanly on glibc 2.43 (Ubuntu 26.04 and Fedora 44). Exact offsets and gadgets vary between builds, but the underlying control-flow trick remains the same.

jazho76.github.io · 10 min

TLDR IndexPage 5