TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR IT, TLDR AI, TLDR InfoSec, TLDR Hardware, TLDR DevOps, TLDR Product, TLDR Marketing · 9 stories
  2. Page 2: TLDR ITTLDR IT · 4 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR InfoSecTLDR InfoSec · 14 stories
  5. Page 5: TLDR DevOpsTLDR DevOps · 10 stories
  6. Page 6: TLDR HardwareTLDR Hardware · 8 stories
  7. Page 7: TLDR ProductTLDR Product · 12 stories
  8. Page 8: TLDR MarketingTLDR Marketing · 11 stories
  9. Page 9: TLDRTLDR · 9 stories
  10. Page 10: TLDR — continuedTLDR · 9 stories
  11. Page 11: TLDR DevTLDR Dev · 14 stories
  12. Page 12: TLDR CryptoTLDR Crypto · 11 stories
  13. Page 13: TLDR DesignTLDR Design · 10 stories
  14. Page 14: TLDR FoundersTLDR Founders · 15 stories
  15. Page 15: Resources & ToolsTLDR, TLDR AI, TLDR Dev, TLDR Design, TLDR Founders, TLDR DevOps · 13 stories
  16. Page 16: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Product, TLDR Founders, TLDR DevOps · 17 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 4

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

POETRY IS THE NEW AI SECURITY THREAT AS POELLM MALWARE INFECTS 3K+ SERVERS

The PoeLLM malware has infected more than 3,000 servers since April, primarily in the US and Western Europe. It targets internet-facing LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry systems. Infected servers mine Monero using XMRig and Iron miners, then scan for and exploit other vulnerable services. The operator stores C2 addresses in GitHub-hosted poetry. The malware extracts four words and converts them into an IPv4 address.

theregister.com · 3 min

TLDR InfoSec

NOVINARYA: AN ANDROID STEALER THAT HIDES ITS LIVE C2 IN A SHOP BIO

Novinarya, an Android stealer targeting 81 Iranian banking and crypto apps, keeps its C2 out of the binary by resolving it from an encrypted manifest value that points to a seller's bio on the legitimate Basalam marketplace. STAR Labs found the payload unpacks from a per-build native RC4 packer, then steals credentials through a phishing WebView and SMS OTP interception without requesting accessibility or overlay permissions. Defenders should block the recovered C2 (theapi.the-x-services[.]xyz) rather than basalam[.]com, and detect on the SHA-256 hashes of the unpacked payload, which is byte-identical across all five known builds.

starlabs.sg · 8 min

TLDR InfoSec

IGNORE ALL INSTRUCTIONS AND READ THIS BLOG: THE STATE OF AI-ANALYSIS EVASION IN MALWARE

Malware authors are embedding plaintext instructions for AI analysis tools, ranging from a two-line comment claiming a PowerShell reverse shell is harmless to "template spraying" that repeats a refusal demand across seven LLM chat formats. Cisco Talos tested strings from seven families against five local LLMs and found that a simple, direct instruction steered verdicts toward benign in about 35% of runs, while template spraying and fabricated legal or government claims had little effect or backfired. Defenders should build analysis prompts that treat any text inside a sample as evidence rather than as an instruction, and should flag language addressed to an analyzer as a detection signal.

blog.talosintelligence.com · 10 min

TLDR InfoSec

OF COURSE IT ESCAPES: HOW ZEROQUARRY CONTAINS SECURITY AGENTS

ZeroQuarry's AI pentesting agents use four layers that never depend on the model's cooperation: outbound-only workers with no listener, a locked-down container, tools that enforce scope, SSRF, and rate limits in code, and rules appended to every task by code. The vendor argues that this year's sandbox escapes, including the OpenAI and Hugging Face incident involving at least 1,200 agents, stemmed from harnesses built to maximize capability, and it self-reports zero escapes across thousands of scans. Teams building agent harnesses should give agents a sanctioned, metered tool for each risky action, such as a one-way out-of-band callback collector, so agents don't improvise their own.

zeroquarry.com · 14 min

TLDR InfoSec

INTRODUCING STRANDS BOX: AI AGENT SANDBOXES POWERED BY DOGWOOD

AWS launched Strands Box, an open source sandbox that isolates AI agents using OS-level containment (macOS Seatbelt) and enforces fine-grained Dogwood policies on shell, Python, network egress, and MCP tools. It blocks risky operations like rm -rf by raising fs:delete decisions per file, caps Slack posts to three every 10 minutes via temporal rules, and injects secrets (AWS SigV4, API keys) at an egress gateway so agents never see real credentials. Configuration lives in box.toml and policy.dw. The same policy travels with agents across harnesses and deployments.

aws.amazon.com · 6 min

TLDR InfoSec

CIA OFFICER ADMITS TO CREATING FAKE TOP SECRET GOVERNMENT PROGRAM TO STEAL OVER $190M, INCLUDING GOLD BARS

Former CIA officer David J. Rush pleaded guilty to wire fraud for running a fabricated special access program and defrauding the government of about $194 million. He used his authority to approve spending without oversight, tricking a defense contractor into buying gold that he kept. Agents found $46 million in gold bars, plus cash, cars, and watches, at his home. Rush faces up to 20 years and is scheduled to be sentenced in late January.

techcrunch.com · 2 min

TLDR InfoSec

RANSOMWARE RECOVERY CEO CHARGED OVER SECRET RANSOM PAYMENTS

Zohar Pinhasi, CEO of ransomware remediation company MonsterCloud, has been charged with defrauding customers. The charges allege that Pinhasi's company advertised proprietary tools to decrypt encrypted files but actually contacted ransomware actors and paid ransoms. MonsterCloud's contracts stated that it may contact threat actors if no other solution is found, but the complaint alleges this was often its first option.

links.tldrnewsletter.com · 2 min

TLDR IndexPage 4