TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR Data, TLDR AI, TLDR InfoSec, TLDR Hardware, TLDR, TLDR Crypto, TLDR Founders, TLDR IT · 9 stories
  2. Page 2: TLDR DataTLDR Data · 13 stories
  3. Page 3: TLDR AITLDR AI · 9 stories
  4. Page 4: TLDR AI — continuedTLDR AI · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 9 stories
  6. Page 6: TLDR HardwareTLDR Hardware · 11 stories
  7. Page 7: TLDRTLDR · 15 stories
  8. Page 8: TLDR DevTLDR Dev · 12 stories
  9. Page 9: TLDR CryptoTLDR Crypto · 11 stories
  10. Page 10: TLDR FoundersTLDR Founders · 14 stories
  11. Page 11: TLDR DesignTLDR Design · 12 stories
  12. Page 12: TLDR MarketingTLDR Marketing · 10 stories
  13. Page 13: TLDR DevOpsTLDR DevOps · 12 stories
  14. Page 14: TLDR FintechTLDR Fintech · 13 stories
  15. Page 15: TLDR ITTLDR IT · 8 stories
  16. Page 16: TLDR IT — continuedTLDR IT · 8 stories
  17. Page 17: Resources & ToolsTLDR Dev, TLDR InfoSec, TLDR Design, TLDR Data, TLDR DevOps · 11 stories
  18. Page 18: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR Founders, TLDR Marketing, TLDR Data, TLDR DevOps, TLDR Fintech, TLDR IT · 18 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TELEGRAM DESKTOP ONE CLICK ACCOUNT TAKEOVER

A single clicked link could clone a Telegram Desktop session on 7.2.8 and earlier, because an unescaped semicolon in tg: link IPC handling let attackers inject a hidden interpret: release helper that uploads local files to any chat (CVE-2026-107181). Attackers staged instruction files through auto-download in a group the victim was added to without consent, then exfiltrated the three tdata files that open on another machine with no SMS code or two-step password when no local passcode is set. Users should update to 7.2.9, set a local passcode, and restrict group adds to My Contacts, since Telegram shipped the fix with no advisory.

hackingpassion.com · 8 min

TLDR InfoSec

BELOW THE WATERLINE STAGE 2 - REGULATING RED TEAMS

Regulated red team engagements have to be defensible when reconstructed later, so every action needs a named approver, an understood risk, and evidence tying it to the threat scenario. The six frameworks compared (CBEST, TIBER-EU, DORA TLPT, I-CRT, iCAST, and DESC ISR) differ in authority, testing basis, and provider requirements, with DORA Article 26 mandating TLPT at least every three years for designated financial entities. Red team leads should record timestamps, approvals, and any supplied access during delivery, because a detection that fires in purple-team replay does not prove it worked during the covert phase.

blog.zsec.uk · 9 min

TLDR InfoSec

WHY THE AI VULNPOCALYPSE ISN'T THE BREACHPOCALYPSE (YET)? IT'S THE ECONOMY, STUPID

Despite the rise in vulnerabilities due to LLMs, we have not observed a corresponding rise in breaches. The author argues that offensive AI agents cannot properly monetize breaches, which reduces their motivation. The author dismisses the hypothesis that attackers lack capable enough tools for breaches, given that cyber-capable open-weight models and model jailbreaks are common. The author also dismisses the hypothesis that breaches are occurring without us knowing.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

GHOSTACTION PHISHING CAMPAIGN

GhostAction operators used a GitHub reverse-proxy kit on my-github[.]com to relay maintainers' passwords and TOTP codes, while injected JavaScript silently approved an OAuth device flow with repo, workflow, and read:org scopes. The domain shared 193.32.204[.]199 with GhostAction's workflow exfiltration server, though a single lure does not prove phishing caused the earlier maintainer compromises. Defenders should revoke grants tied to OAuth client ID Ov23ctrqCqZ79UaYKwyq, rotate CI/CD and registry secrets, and audit .github/workflows/ for injected files.

opensourcemalware.com · 9 min

TLDR InfoSec

AN OPT-IN VULNERABILITY-FINDING SERVICE FOR OPEN-SOURCE SOFTWARE

Anthropic launched OSS Scanner, a free, opt-in tool that periodically sends open-source maintainers model-generated vulnerability reports. The reports include reproducers, explanations, and candidate patches, but humans don't review them. During validation, 85 of 97 critical- or high-severity findings met Anthropic's disclosure bar, while one finding was invalid. Eligible maintainers can sign up through GitHub.

anthropic.com · 3 min

TLDR InfoSec

INSIDER CYBER EXTORTION PLOT AGAINST INDUSTRIAL FIRM LANDS ENGINEER IN PRISON

Former core infrastructure engineer Daniel Rhyne scheduled tasks on his employer's domain controller to delete 13 admin accounts and reset passwords affecting 301 users, 254 servers, and 3,284 workstations. He demanded 20 bitcoin, about $750,000, and threatened to shut down 40 servers daily. The company did not pay. Internal forensics and FBI tracing tied the activity to Rhyne's home IP address. He received 32 months in prison.

links.tldrnewsletter.com · 2 min

TLDR IndexPage 5