TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR IT, TLDR InfoSec, TLDR AI, TLDR, TLDR Crypto · 9 stories
  2. Page 2: TLDR ITTLDR IT · 10 stories
  3. Page 3: TLDRTLDR · 8 stories
  4. Page 4: TLDR — continuedTLDR · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR AITLDR AI · 9 stories
  7. Page 7: TLDR AI — continuedTLDR AI · 9 stories
  8. Page 8: TLDR CryptoTLDR Crypto · 12 stories
  9. Page 9: TLDR DevTLDR Dev · 13 stories
  10. Page 10: TLDR ProductTLDR Product · 11 stories
  11. Page 11: TLDR DesignTLDR Design · 11 stories
  12. Page 12: TLDR MarketingTLDR Marketing · 12 stories
  13. Page 13: Resources & ToolsTLDR AI, TLDR InfoSec, TLDR Design · 6 stories
  14. Page 14: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto, TLDR Product, TLDR Marketing, TLDR IT · 15 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

NEW DELL SYSTEM UPDATE FLAW LETS HACKERS GAIN ROOT PRIVILEGES

A critical path traversal flaw in Dell System Update (CVE-2026-86360) allowed unauthenticated remote attackers to execute code as root on PowerEdge servers using the DSU deployment tool. Dell's advisory also addressed four other high-severity DSU vulnerabilities: two that enable remote code execution (CVE-2026-63697 and CVE-2026-71168) and two that enable privilege escalation (CVE-2026-86361 and CVE-2026-86362). None have been reported as exploited so far. Admins should upgrade to DSU 2.3.0.0 or later.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

OPEN BUILD SERVICE, ONE YEAR LATER: COMMAND EXECUTION THROUGH MERCURIAL ARGUMENT INJECTION

Fenrisk found CVE-2026-56004 in Open Build Service's obs_scm Mercurial backend. An attacker-controlled _service revision beginning with --config could set a pre-update hook and run shell commands on the service server. A space in the value bypassed Python argparse handling of dash-prefixed arguments. Exploitation required Mercurial, a reachable HTTP(S) repository, and a successful clone. Fenrisk confirmed build.opensuse.org was vulnerable. openSUSE patched the flaw on July 2 by adding -- before the revision and recommending rejection of dash-prefixed revisions.

fenrisk.com · 6 min

TLDR InfoSec

A PEEK INTO REDDIT'S ANTI-SPAM INTERNALS

A 2021 Reddit glitch exposed internal removal reasons in Relay notifications. Screenshots reveal domain blocks, account bans, shadowbans, Spamurai rules, and URL inspection. Spamurai logged account age, karma, reports, ISP, email domain, browser details, language headers, TLS fingerprints, and referrers. This reproduced a Perspective API score and showed that appending two letters changed a spam score from 86% to 1%. Reddit also followed redirected URLs, scanned page content, and matched a Google Analytics ID tied to a spam ring.

lyra.horse · 16 min

TLDR InfoSec

YOUR CAR IS A SMARTPHONE ON WHEELS. HERE'S WHO'S LISTENING

Northeastern researchers and Consumer Reports captured Wi-Fi traffic from 21 vehicles through a Raspberry Pi access point, decrypted 30 companion iOS apps with mitmproxy, and found that 19 vehicles contacted at least one third party, including ad and tracking domains. Seven apps sent VINs, emails, phone numbers, or precise location to trackers, and GM's four apps shared VINs with ten companies, including Meta, Google, and Acxiom. Pairing a companion app roughly doubled a vehicle's tracker exposure on average, and of 17 manufacturers contacted, most shifted responsibility to owners. One notable exception: Honda improved its data collection practices to avoid sending precise geolocation information to a third party involved in user tracking.

automatictransmission.khoury.northeastern.edu · 7 min

TLDR InfoSec

SHINYHUNTERS HACKER IN FBI DATA THEFT DETAINED IN JORDAN, COOPERATING WITH BUREAU, SOURCES SAY

Jordanian authorities detained alleged ShinyHunters member Saif al-Din Khader, known as Rey. Two sources said he is helping the FBI identify other members through his devices and correspondence with a sample of stolen FBI data containing employee identities, job details, and medical and psychiatric records. The group's dark-web site disappeared after another alleged member was detained in the Netherlands.

links.tldrnewsletter.com · 4 min

TLDR IndexPage 5