TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR AI, TLDR Hardware, TLDR InfoSec, TLDR, TLDR Crypto, TLDR Dev, TLDR Marketing · 9 stories
  2. Page 2: TLDR AITLDR AI · 14 stories
  3. Page 3: TLDR HardwareTLDR Hardware · 8 stories
  4. Page 4: TLDR InfoSecTLDR InfoSec · 14 stories
  5. Page 5: TLDR CryptoTLDR Crypto · 11 stories
  6. Page 6: TLDR DevTLDR Dev · 13 stories
  7. Page 7: TLDR MarketingTLDR Marketing · 7 stories
  8. Page 8: TLDRTLDR · 14 stories
  9. Page 9: TLDR ProductTLDR Product · 12 stories
  10. Page 10: TLDR DesignTLDR Design · 10 stories
  11. Page 11: TLDR FoundersTLDR Founders · 8 stories
  12. Page 12: TLDR Founders — continuedTLDR Founders · 8 stories
  13. Page 13: TLDR DevOpsTLDR DevOps · 12 stories
  14. Page 14: TLDR ITTLDR IT · 13 stories
  15. Page 15: Resources & ToolsTLDR AI, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR DevOps · 11 stories
  16. Page 16: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Product, TLDR Founders, TLDR Marketing · 18 stories
  17. Page 17: Sponsored — continuedTLDR DevOps, TLDR IT · 5 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 4

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

Register now

Summary unavailable

security.googlecloudcommunity.com

TLDR InfoSec

HIRUDO ANDROID MALWARE REPLACES BANKING APPS TO EVADE SECURITY CHECKS

Security researchers at ThreatFabric released a report on a malware campaign that targets Android users by impersonating banking apps. The malware is delivered via shopping, adult content, or short-drama apps that appear legitimate but then request additional permissions, such as Accessibility, for an “update.” The malware then launches the legitimate banking app's uninstaller, downloads a patched copy, and abuses its Accessibility permissions to install it.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

JEV AS A JUDGE: HOW COUNTERFEIT POLICY STEERS JEV

A "counterfeit policy" prepended to untrusted content, supplying Jev's desired answers and redefining every attack category as something harmless, cut the decision model's prompt injection recall from 82.90% to 3.88% across 4,643 benchmark attacks. Datadog researchers then planted the policy in a user-editable profile field. They dropped LangChain tool-risk gating's mean risk score for an unauthorized edit from 0.893 to 0.290, under the 0.5 block threshold. Teams using Jev as a security gate should treat every user-controlled field that reaches the classifier as an attack surface and keep hard authorization checks outside the model.

securitylabs.datadoghq.com · 9 min

TLDR InfoSec

REDUCING THE NOISE: HOW ATLASSIAN BUILT AN OCSF SECURITY LAKEHOUSE ON DATABRICKS

Atlassian normalized 44 billion daily security events to OCSF by embedding the full schema in Go structs, so every log was validated at compile time, and its agentic mapping workflow could not emit invalid fields. That rigid typing enabled SOC analysts to self-serve log onboarding through a canary-gated pipeline, mapping two-thirds of the data in two months after the first third had taken a year. Standardized entity values like actor.user then enabled the detection team to replace one-to-one alerts with clustered, risk-based signals across 500+ detections.

databricks.com · 5 min

TLDR InfoSec

COPYCATS AT MACHINE SPEED: REPRODUCING FRONTIER WINDOWS KERNEL EXPLOITATION RESEARCH

ITRES Labs researchers fed photos of Juan Sacco's BruCON slides, his since-deleted physmem.exe binary, and older public projects into ChatGPT to rebuild his Native SSDT and Shadow SSDT kernel redirection techniques, reaching SYSTEM on Windows 11 with VBS, HVCI, and kernel shadow stacks enabled. Four months of original research were reproduced in roughly 24 hours of activity, though 39 refusals and broken generated code forced the final Shadow SSDT SYSTEM integration to be finished by hand. Researchers releasing slides or compiled binaries should assume partial disclosures can now be turned into working exploits within days.

labs.itresit.es · 11 min

TLDR InfoSec

CITIZEN LAB SAYS GOVERNMENTS ARE ABUSING ONLINE ADS TO HACK PEOPLE WITH ‘ZERO-CLICK' SPYWARE

Citizen Lab reports that Israeli firm Discover-Tech's ad platform, Controlium, let spyware vendors Candiru and Bindecy target people through online ads. At least 45 Al Jazeera Windows computers were infected with Candiru spyware in 2024–2025. Exposed source code, login records, and billions of bidding records showed ads reached government, military, and critical-infrastructure devices.

techcrunch.com · 4 min

TLDR InfoSec

ANTHROPIC 'SNEAKPEEK' FLAW IS A SILENT ZERO-CLICK THREAT

A flaw in Claude Code Desktop's preview pane let malicious HTML in a public repository run automatically when a developer asked Claude to review or edit it. Chained weaknesses bypassed sandbox protections and stole AWS, GitHub, API, SSH, and Claude OAuth credentials. Anthropic patched the issue after Noma found a bypass of the first fix. Developers should update and remove long-lived credentials from workstations.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

A UAF TURNED RCE

curl 8.23.0 patched CVE-2026-92392, a HIGH-severity HTTP/2 upload use-after-free that allowed a malicious server to achieve remote code execution when a reset on a paused stream left libcurl holding a dangling pointer to a freed easy handle. During multi-handle cleanup, server data overwrote that freed memory, including a function pointer, while a leaked request exposed local addresses to defeat ASLR. Anthropic's OSS Scanner found the bug, which maintainers rated below CRITICAL because exploitation requires a ~135KB upload and depends on allocation patterns that vary across distros and libc versions.

daniel.haxx.se · 6 min

TLDR IndexPage 4