TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-02-05

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

EVEREST RANSOMWARE CLAIMS 90GB DATA THEFT INVOLVING LEGACY POLYCOM SYSTEMS

The Everest ransomware group claimed to have exfiltrated 90GB of internal data from systems linked to Polycom, now owned by HP Inc., including engineering build environments, source code, and technical documentation for the RMX and RealPresence conferencing platforms. Evidence suggests the data originated in legacy Polycom environments from 2017–2019, predating HP's acquisition, though it remains unclear when the systems were accessed. HP Inc. has not confirmed the breach.

hackread.com2 min read

VULNERABILITIES ALLOWED FULL COMPROMISE OF GOOGLE LOOKER INSTANCES

Tenable researchers uncovered LookOut, two flaws in Google Looker that allow attackers with developer rights to run remote code, steal secrets, and exfiltrate the internal MySQL database via an auth bypass and error-based SQL injection. Google patched cloud-hosted instances in September 2025, but self-hosted deployments must update, though no active exploitation has been detected.

links.tldrnewsletter.com3 min read

BIG BREACH OR SMOOTH SAILING? MEXICAN GOV'T FACES LEAK ALLEGATIONS

Hacktivist collective Chronus claims to have leaked 2.3TB of data from at least 25 Mexican government bodies, potentially exposing personal and healthcare records of 36 million citizens. Mexico's ATDT argues the dump repackages old breaches from obsolete third‑party systems, not fresh sensitive data.

links.tldrnewsletter.com4 min read

02STRATEGIES & TACTICS

GATEWAYTOHEAVEN: FINDING A CROSS-TENANT VULNERABILITY IN GCP'S APIGEE

A cross-tenant vulnerability (CVE-2025-13292) discovered in Google Cloud's Apigee allowed attackers to chain SSRF via the GKE metadata endpoint, to escalate privileges via Dataflow JAR poisoning, and to abuse autoscaling to access analytics data across all Apigee tenants, including plaintext OAuth access tokens. The attack exploited shared cross-tenant metadata buckets lacking tenant-specific path isolation and overly permissive service account permissions within tenant projects. Organizations using managed multi-tenant cloud services should audit tenant isolation boundaries, restrict access to metadata endpoints from workloads, and ensure that shared infrastructure components enforce strict per-tenant scoping.

omeramiad.com11 min read

BUILDING SECURITY TO UNLOCK ENGINEERING VELOCITY

Robinhood built SERA (Secure Enhanced Remote Approval), an internal platform that replaces VPN-dependent access approvals with passkey-based biometric authentication, enabling engineers to securely approve requests from any device. The system uses trusted enrollment on corporate devices to bootstrap credentials and then enables flexible remote approvals with tamper-evident audit trails, reducing approval times by over 20%. This approach demonstrates how organizations can reduce friction in security incident response and off-hours workflows without weakening authentication guarantees.

linkedin.com4 min read

EXPLOITING AWS IAM EVENTUAL CONSISTENCY

AWS is a highly distributed system, which can lead to delays as changes propagate across the system. This is known as eventual consistency. This window can be exploited to recreate deleted or disabled AWS access keys within a nearly four-second window while the changes propagate. Disallow the principal from accessing via an SCP, wait 4 seconds, and then use the standard deletion process to prevent an attacker from exploiting eventual consistency. Other IAM operations, such as policy attachment and detachment, and role assumption, share this vulnerability.

offensai.com5 min read

03LAUNCHES & TOOLS

CLAUDE-CODE-TRANSCRIPTS

claude-code-transcripts is a Python CLI tool that converts Claude Code sessions into detailed, shareable HTML pages capturing prompts, tool calls, thinking traces, and commits. The tool supports both local Claude Code sessions and Claude Code for web via a reverse-engineered private API. It is useful for maintaining audit trails of AI-assisted development decisions and evaluating prompting strategies across coding agent workflows.

simonwillison.net4 min read

ORION SECURITY (PRODUCT LAUNCH)

Orion provides an AI-driven data protection platform that maps how sensitive information moves across an organization, detects risky or abnormal data flows in real time, and automatically prevents leaks and insider-driven data loss across modern cloud environments.

orionsec.io

SPICEDB

Spicedb is an open-source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data.

github.comGitHub repository

04MISCELLANEOUS

MOZILLA ANNOUNCES SWITCH TO DISABLE ALL FIREFOX AI FEATURES

Following user backlash, Mozilla announced that it will be adding a toggle to delay current and future AI features. Along with this toggle, there will be an AI control panel where users can selectively enable or disable specific features. Features will begin enabled in the AI control panel until users choose to disable them if they do not use the “Block AI Enhancements” toggle.

bleepingcomputer.com2 min read

NITROGEN RANSOMWARE IS SO BROKEN EVEN THE CROOKS CAN'T UNLOCK YOUR FILES

Ransomware gang Nitrogen shipped an ESXi encryptor with a fatal bug that corrupted its own Curve25519 public key, making decryption mathematically impossible even if victims pay. The slipup turns a profit-driven campaign into pure destruction: criminals earn nothing while organizations are left with unrecoverable hypervisors and costly rebuilds.

theregister.com2 min read