Search the archive

Register now — space is limited!

CUPS: A CRITICAL 9.9 LINUX VULNERABILITY REVIEWED

HPE ARUBA NETWORKING FIXES CRITICAL FLAWS IMPACTING ACCESS POINTS

HPE Aruba Networking has fixed critical vulnerabilities in its Access Points that allowed attackers to execute code remotely. Attackers could exploit the flaws by sending specially crafted packets to the PAPI UDP port. Admins are urged to install security updates to prevent potential attacks, with workarounds available for temporary protection.

OVER 90M FRENCH RECORDS EXPOSED

Cybernews and another security researcher discovered an exposed Elasticsearch instance containing 90M records on French citizens (France has a population of 67.79M). The data seems to have been collected by a data hoarder and comprises data from at least 17 breaches. The data contains full names, phone numbers, physical addresses, email addresses, partial payment information, and other data.

HACKING KIA: REMOTELY CONTROLLING CARS WITH JUST A LICENSE PLATE

This post describes in detail a vulnerability in Kia's remote activation system that allowed an attacker to remotely control Kia vehicles using just a license plate number. The attack flow involved generating dealer tokens, retrieving victim information, and modifying access to take control of the vehicle. While this vulnerability has been fixed and the the hacking tool was never released or used maliciously, similar vulnerabilities may be present in other manufacturer's systems.

APPLYING SECURITY ENGINEERING TO MAKE PHISHING HARDER - A CASE STUDY

Doyensec conducted a security review for a client's communication platform to prevent phishing and social engineering attacks. Vulnerabilities such as file extension bypass and subdomain crafting were identified and addressed. Recommendations included removing trailing dots in filenames and implementing stricter URL filtering to enhance security.

CVE HUNTING MADE EASY

An automated process hunting for CVEs at scale across all WordPress plugins resulted in 14 new CVEs over three afternoons of work. The process involved downloading and cataloging all WordPress plugins, then running Semgrep on any plugins with recent releases and at least one install. Any findings were then manually reviewed and exploits were attempted. A worked example of the process is included at the end of the blog post.

Ready to ditch the security theater? Request Pricing Here

ONLYHUMANS PROXY

An experimental proxy that serves static websites as an image to defeat crawlers and scrapers.

UNICORN ENGINE V2.1.0

Unicorn emulator framework's 2.1.0 release introduces significant performance improvements, including up to 40x faster write speeds and optimized memory allocation. The release brings enhanced cross-platform support, full M1 compatibility, restored Python 2 compatibility, and new or improved bindings for Python, Java, and .NET. Other new features include QEMU logging revival, snapshot memory support, MMU bypass option, and various improvements across different architectures like RISCV and PPC32.

DNA

Dna is a static binary analysis framework built on top of LLVM, mostly written in C#. It includes features like control flow graph reconstruction and jump table solving. Dna supports x86_64 architecture but recompiled code is not CET compliant and requires custom patches to build on Windows.

CYBERSECURITY BURNOUT IS A REAL RISK

67% of respondents on ISC surveys feel like there is a shortage of staffing and 90% of organizations have a security skills gap, highlighting the fact that cybersecurity professionals at all levels are experiencing burnout. Organizations should take these statistics into account and aid their security teams. CISOs should push boundaries, advocate for their teams, and be cognizant of burnout potential in their organizations.

NIST PROPOSES NEW PASSWORD REQUIREMENTS

NIST has released a new draft of SP 800-63-4 that contains Digital Identity Guidelines. Notably, this version bars requirements for security questions, periodic password resets, and forced usage of specific character classes. Other notable inclusions are recommendations to use a 15-character minimum and requirements to accept all printing ASCII characters, accept Unicode characters, and implement a password maximum of at least 64 characters.

FIND THE RIGHT OSINT TOOLS WITH BELLINGCAT'S NEW ONLINE INVESTIGATIONS TOOLKIT

Bellingcat has published a new version of its Online Investigations Toolkit based on interviews with practitioners. The new toolkit is divided into categories to make locating tools easier and features in-depth descriptions of the tools, whether they are free or paid, and sample usage. Bellingcat is treating this version as collaborative and will be updating it based on community feedback.

IRISH DATA PROTECTION COMMISSION FINED META €91 MILLION FOR STORING PASSWORDS IN READABLE FORMAT

The Irish Data Protection Commission fined Meta €91 million for storing user passwords in a readable format, violating data protection regulations.

IRANIAN HACKERS CHARGED FOR ‘HACK-AND-LEAK' PLOT TO INFLUENCE ELECTION

Three Iranian hackers associated with Iran's IRGC have been charged by the DOJ for a "hack-and-leak" scheme targeting the 2024 U.S. presidential election.

THREAT LANDSCAPE FOR INDUSTRIAL AUTOMATION SYSTEMS, Q2 2024

Kaspersky ICS CERT has published the threat landscape for Industrial Control Systems Computers for Q2 2024.

studies.

* Paragon's Growth Marketing Manager mentions “TLDR allows us to connect with engineers who aren't on social media…Our CTO reads TLDR but doesn't scroll LinkedIn. ” * Redact's Head of Marketing saw LinkedIn-level traffic at half the CPC * Bland AI gained a Slack-breaking number of leads

TIKTOK PARTNERS WITH WHO TO COMBAT MEDICAL MISINFORMATION

TikTok has joined forces with the World Health Organization's Fides group to improve its medical fact-checking efforts. The Fides network, consisting of over 800 healthcare professionals, will create evidence-based content on TikTok to address important health topics. This partnership aims to enhance TikTok's role in educating younger audiences and ensure accurate health information.

CONSUMERS' MOODS—AND PURCHASES INTENT—GOES UP AT THE MOVIES, REPORT FINDS

Going to the movies can increase people's moods, leading to greater brand favorability and purchase intent. As social media use declines due to its negative emotional effects, more young adults are turning to real-life experiences. Over 60% of 18-24 year-olds have attended a movie recently. 78% of moviegoers feel good during their visits, resulting in an 18% increase in brand favorability and a 35% boost in purchase intent.

7 TACTICS FOR ECOSYSTEM-LED OUTBOUND

Deals influenced by ecosystems close 53% more often and 46% faster as companies adopt an ecosystem-led outbound strategy to overcome traditional outbound challenges. This approach focuses on leveraging partner relationships and intent signals to identify high-priority accounts, with tactics such as integrating partner overlap data into CRMs and hosting “Funnel GPS Calls” to align sales, marketing, and partnerships.

STANLEY'S CHIEF BRAND OFFICER TALKS COLLEGE CAMPUS TOUR, AMBASSADOR PROGRAM, AND PRODUCT INNOVATION

Stanley's digital engagement, fueled by TikTok trends like “pack my Stanley with me,” has now expanded into in-person college campus activations to build deeper connections with Gen Z. The Stanley Studio H2O tour will visit 13 campuses, offering free engraving and product demos, with student ambassadors hosting events that integrate Stanley products into everyday student life.

PASSING THE BUTTON-CLICKER TEST, AND OTHER 0 TO 1 LESSONS FROM LATTICE'S FIRST MARKETING HIRE

Lattice's early marketing focused on building organic growth by heavily investing in SEO and content. One challenge was balancing high-priority tasks with distractions, which led to the creation of the “button-clicker test” to identify impactful actions. Lattice's first marketing hire worked closely with the product team to ensure marketing efforts aligned with product development. They prioritized customer insights to fine-tune their messaging, which helped Lattice establish a customer-centric marketing foundation.

lives in Planable. Get started for free →

ADCREATIVE.AI

AdCreative.ai generates high-converting ad creatives tailored to your audience preferences using AI. Its features include creative generation, text and headline generation, ad scoring, and competitor ad tracking. The tool offers a 1 week free trial and then starts at $15 per month.

HOW PERPLEXITY'S GROWTH IS CHANGING SEARCH HABITS

Perplexity.ai is growing as a search alternative to Google by offering concise, accurate answers with sources. Perplexity focuses on user-centric features like related questions, real-time updates, and clean UI. Despite its smaller user base compared to Google and ChatGPT, its rapid growth and premium subscription model show strong potential. The platform also plans to introduce targeted advertising while expanding partnerships with publishers through a revenue-sharing program.

UNPACKING NERDWALLET'S SEO: 10 THINGS I DISCOVERED

NerdWallet's SEO performance faltered in 2024, losing 6 million in organic traffic due to Google's core update, seasonal search demand, and increased competition from specialized sites and its own financial partners. The company responded by enhancing content trustworthiness and strategically redirecting pages to regain some lost traffic. Its SEO still drives significant revenue, but diminishing returns from programmatic content and competition from partners like Chase pose ongoing challenges.

GROWTH STORY OF REDDIT TO 1 BILLION MONTHLY USERS - A TACTICAL PLAYBOOK FOR FOUNDERS AND MARKETERS

Reddit's growth from a niche forum to 1 billion monthly users was fueled by UGC and strong community engagement, with subreddits allowing users to create niche communities around specific interests. Early on, Reddit's founders faked user activity to make the platform seem active, which helped attract real users. The introduction of AMAs and a mobile-first strategy also played a critical role in driving user engagement.

THE FUTURE OF SEO IS USER-GENERATED CONTENT

The future of SEO is moving toward User-Generated Content (UGC) as AI takes over traditional content creation and search rankings. Platforms like Miro, Notion, and Canva have leveraged UGC to fuel growth with user-created templates and resources. While UGC requires long-term investment and user incentives, it offers a competitive edge that's hard to replicate. Companies can improve SEO and deepen user loyalty by embedding UGC into activation and re-engagement journeys.

TIKTOK MAGIC: HOW FOUR BRANDS CASHED IN ON GOING VIRAL

How brands like Stanley and Dr. Scholl's leveraged TikTok virality into sales.

CHARTING 'CHEAPFLATION': HOW BUDGET BRANDS GOT SO PRICEY

Cheapflation occurs when prices of lower-cost products rise more quickly than those of premium goods, diminishing consumer savings.

EVERYTHING YOU NEED TO KNOW ABOUT PYTHON 3.13 – JIT AND GIL WENT UP THE HILL

Python 3.13 (officially releasing on October 1) introduces two major changes: a "free-threaded" version that allows disabling the Global Interpreter Lock (GIL), potentially boosting multi-threaded performance, and experimental Just-in-Time (JIT) compilation, which could improve performance over time. The GIL removal addresses Python's limitations in fully utilizing multi-core processors, while the JIT compiler promises to optimize code execution by generating machine code on the fly.

A TAXONOMY OF TECH DEBT

An engineering manager at Riot Games proposes a taxonomy for categorizing tech debt based on three metrics: impact, fix cost, and contagion. The impact measures the negative effects of the debt, fix cost assesses the resources needed to rectify it, and contagion quantifies its potential spread. He identifies four types of tech debt: local debt, MacGyver debt, foundational debt, and data debt, each with unique characteristics and strategies for mitigation.

BUILD A SERVERLESS ACID DATABASE WITH THIS ONE NEAT TRICK (ATOMIC PUTIFABSENT)

This blog post goes through implementing a serverless ACID database using 500 lines of Go code with no external dependencies. It uses atomic “PutIfAbsent” operations on a file system-based object store to achieve concurrency control and snapshot isolation. Working code examples are shown throughout the post.

TYPES VS NO TYPES

Using types in programming is similar to color-coding wires in an electrical system. Types act as labels, making it easier to understand the flow of data in code and preventing mismatches. They also provide automatic error checking and make it simpler to identify and fix issues, so they should always be used in complex codebases.

I AM TIRED OF AI

This software testing expert is frustrated with the overhyped and often ineffective use of AI in various domains. He feels that AI's current applications often lack depth and fail to replace human creativity and critical thinking. He especially dislikes the mindless adoption of AI without considering its real value and impact.

IT'S HARD TO WRITE CODE FOR COMPUTERS, BUT IT'S EVEN HARDER TO WRITE CODE FOR HUMANS

Writing code for humans is much harder than writing code for computers because it involves understanding and catering to a user's mental model of the code. To do this well, devs should prioritize user onboarding, provide clear examples rather than abstract concepts, and create a user-friendly experience by minimizing conceptual overload.

Start building!

BETTER AUTH

Better Auth is a framework-agnostic authentication and authorization library for TypeScript. It provides a consistent API and has a plugin ecosystem. Better Auth supports features like email & password authentication, account and session management, rate limiting, database management, social sign-on, organization and access control, two-factor authentication, and more.

PAGODA

Pagoda is a starter kit for Go web development. It uses libraries like HTMX and Alpine.js to create a modern UI without relying on JavaScript. Pagoda is built on a foundation of popular frameworks like Echo for backend and Ent for ORM, with SQLite as the default database.

MITATA

mitata is a benchmark tooling library for JavaScript and C++ that provides high-resolution timing, visualizations, and automatic garbage collection.

IF YOUR AI SEEMS SMARTER, IT'S THANKS TO SMARTER HUMAN TRAINERS

AI models are getting better thanks to human trainers who verify the accuracy and reliability of AI outputs. They teach models to avoid errors and hallucinations, while also providing high-quality data that makes the models' outputs better overall.

HOW ALPHACHIP TRANSFORMED COMPUTER CHIP DESIGN

AlphaChip is a reinforcement learning method developed by Google that uses AI to create chip layouts in hours, a process that previously took weeks or months. It was created initially for Google's Tensor Processing Units (TPUs) and generates layouts that outperform human design. These layouts are used in chips worldwide.

VISUAL STUDIO CODE IS DESIGNED TO FRACTURE

While VSCode's source code is open, Microsoft uses a proprietary license for the downloadable product and strategically incorporates telemetry and other features that fracture the open-source community. This strategy creates legal barriers for companies like Gitpod, GitLab, and others who attempt to build competing products based on VSCode.