The New York Attorney General's investigation revealed Tether was only 74% backed when confronted, operating without banking access globally from mid-2017 to September 2017 while holding just $61 million against 442 million tokens in circulation, with executives admitting under oath to using customer reserves as a "corporate slush fund" to cover Bitfinex's $850 million losses. University of Texas research identified specific manipulation patterns where 95 one-hour periods representing 1% of trading time accounted for 60% of Bitcoin's price gains, with purchases timed following market downturns and attributed to a single large entity operating across exchanges. Despite $61 million in regulatory fines, an ongoing DOJ investigation, and never completing the independent audit promised since 2015, Tether has grown to over $120 billion circulation, potentially becoming "too big to fail" as exchanges, institutions, and regulators may prefer maintaining the illusion rather than triggering a collapse that could eliminate $2-2.7 trillion in cryptocurrency market value and destroy the industry's foundational legitimacy claims.
PancakeSwap's CakePad is a rebrand of its Initial Farm Offerings (IFOs) that gives users early access to new token launches without staking or lock-ups.
OpenAI's upcoming AI hardware device, currently being designed by Jony Ive, has reportedly been delayed due to three major challenges: insufficient computing power, unresolved privacy concerns over its always-on cameras and microphones, and difficulty defining its personality and conversational boundaries. The device, known as “io”, is neither a phone nor glasses and aims to feel like a helpful friend rather than a “weird AI girlfriend.” It may not launch next year as planned.
Visual Electric, a Sequoia-backed AI design startup founded in 2022, announced it is being acquired by search startup Perplexity, with its team joining a new Agent Experiences group. The acquisition will result in Visual Electric shutting down its product within 90 days, offering users data export and prorated refunds. The startup, which raised $2.5 million and built AI-powered image creation tools for designers on an infinite canvas, was founded by former employees from Facebook, Dropbox, Apple, and Microsoft.
Squarespace partnered with Perplexity to integrate its website-building and hosting services into Comet, Perplexity's browser, enabling users to transition seamlessly from AI-powered research to professional business creation. Through Comet's conversational interface, users receive guidance on domain registration, brand development, and design while accessing Squarespace's AI optimization tools for enhanced discoverability. The collaboration aims to help businesses make a strong first impression when discovered through AI-powered search and answer engines.
Microsoft has refreshed its ten core Office app icons for the first time since 2018, introducing smoother curves, vibrant gradients, and simplified shapes to make them more legible and approachable. The subtle redesign maintains familiar letter plates for instant recognition and reflects how AI is influencing design and product development. The new icons will roll out soon across web, desktop, and mobile.
In design, iteration is essential—ideas are tested, refined, and improved—while in life and philosophy, people often cling to fixed beliefs as part of their identity. Adopting the designer's mindset means viewing our choices, careers, relationships, and convictions as hypotheses to evolve through experience and feedback. Growth, then, comes not from defending old ideas, but from revising them with honesty and courage, choosing truth and adaptability over pride and rigidity.
AI tools are powerful leverage for design and product development, but they amplify whatever users bring to them—whether that's deep user understanding or poor judgment about unsolved problems. While AI excels at processing information and streamlining tedious tasks, it cannot replace the human skills of taste, curation, and genuine curiosity required to build products that people actually want. Designers who either completely resist AI or treat it as a magic solution will struggle, while those who combine human insight with AI capability will thrive.
ImagineArt is an AI creative suite that generates images, videos, shorts, and voice from text prompts. The platform features advanced editing tools, a background remover, an upscaler, and custom models.
Collins has created a visual identity for Sun Day, a new global climate action movement founded by Bill McKibben and Denis Hayes that emphasizes unity, collective action, and the healing power of solar energy. The identity features a flexible half-sun logo that invites individuals to “complete” it, symbolizing shared participation, alongside a living typeface inspired by protest posters and a digital platform where people worldwide can contribute their own suns, reinforcing the idea that everyone is part of one global, solar-powered community.
Sketchbook warm-up exercises help artists loosen up physically and mentally, improving line quality, coordination, and focus before drawing. Common warm-ups include mark-making, drawing parallel lines, circles, shading, scribbling, blind contour drawing, 3D forms, gesture sketches, and creating variations—all designed to build confidence and fluidity. Some artists warm up by directly planning elements of their upcoming sketch.
Designing internal applications presents unique challenges, as users are often required to use the software, making traditional metrics such as user retention irrelevant for measuring design impact. The CASTLE framework addresses this by tracking six key areas—Cognitive Load, Advanced Feature Usage, Satisfaction, Task Efficiency, Learnability, and Errors—that directly connect to business concerns, such as employee productivity, training costs, and software ROI. Designers can demonstrate their value by aligning CASTLE metrics with existing business goals, prioritizing relevant measurements based on specific problems, and gathering data through methods like user testing, support tickets, and pulse surveys.
Illustrator Peilin Li found her distinctive, geometric style by embracing natural expression and storytelling, leading to major awards, global collaborations, and a continually evolving creative practice.
The Wacom MovinkPad Pro 14 combines a 14-inch OLED display with a 2880x1800 resolution, 100% color coverage, and a 120Hz refresh rate, alongside Android 15 and the battery-free Pro Pen 3 with 8,192 pressure levels.
Friend, a new AI companion brand, launched a provocative billboard campaign across NYC subways with statements deliberately designed to spark backlash and graffiti responses.
TypeScript and Zod serve complementary rather than competing roles in development. TypeScript provides compile-time type safety during development and building, while Zod validates untrusted data at runtime. This is very useful for external inputs like API requests, user forms, and third-party data.
React child components behave differently when rendered directly versus passed through the `children` prop. The main difference is in object reference equality: when components are rendered directly, React creates new object references on each render, causing child components to re-render, but when passed via `children`, the same object reference is reused, preventing unnecessary re-renders.
Reactive programming hasn't gained traction in Python due to the complexity of existing tools like RxPY, which are better suited for event streams than state management. New libraries like reaktiv simplify state management similar to spreadsheet formulas. reaktiv uses signals, computed values, and effects to automatically manage dependencies and update values, removing manual coordination and reducing bugs.
Procrastination can be a beneficial strategy. Procrastinators can become productive by prioritizing tasks and working on less important ones to avoid the most urgent ones. The key is to have a list topped with seemingly crucial but flexible deadlines, thus motivating action on other valuable activities.
Most developers are only using a small fraction of Claude Code's capabilities. To fully use it, devs should use Model Context Protocols (MCPs) correctly, set up a good CLAUDE.md configuration file, use Planning Mode for better project structure, and integrate the IDE plugin for real-time error detection and fixes.
ChatKit is a framework from OpenAI to help create AI-powered chat experiences by providing a ready-to-use chat interface with advanced features. It allows devs to easily integrate conversational intelligence into their applications with a quick setup, offering deep UI customization, built-in response streaming, and interactive widgets.
LLMs confidently believe a seahorse emoji exists, even though it doesn't. The author demonstrates this phenomenon across various models and notes that many people also mistakenly remember a seahorse emoji. By using a logit lens, the article shows that LLMs construct a "seahorse + emoji" residual, similar to how they handle real emojis, but because there's no actual seahorse emoji, the model selects a related but incorrect emoji and then can get stuck in a loop.
HelloFresh Group launched Project PUMA (Project Unified Mobile App) to consolidate its fragmented mobile app infrastructure, which previously used separate native Swift/Kotlin codebases for meal kit brands and React Native for ready-to-eat brands. It chose a "brownfield" React Native approach that allows progressive migration while keeping existing native apps functional, enabling them to build features once and deploy across all brands.
This WebGPU diagnostics tool allows users to test shader compilation times and explore device/adapter limits by adjusting shader complexity via sliders.
The minimal amount of CSS needed to create a responsive and decent-looking website takes care of image overflow, good typography, dark mode support, and restrained content width for better readability.
The article covers how caching works across different layers in HTTP (browsers, CDNs, and proxies) and provides detailed explanations of HTTP caching headers like Cache-Control, ETag, and Expires, along with common misconceptions that lead developers to implement broken caching policies.
Oracle issued an emergency security alert for CVE-2025-61882, a critical remote code execution vulnerability in Oracle E-Business Suite that can be exploited over the network without authentication credentials. The vulnerability is already being actively exploited by threat actors. Oracle has discovered specific indicators of compromise, including IP addresses, command-line payloads, and file hashes associated with exploitation attempts. The IOCs reference exploit tools with naming conventions suggesting involvement by groups such as Scattered Spider, Lapsus$, and CL0P, indicating that this vulnerability is being weaponized by ransomware and extortion groups for immediate attacks.
Unity warns developers about a vulnerability identified since version 2017.1 that exposes users to unsafe file loading and local file inclusion attacks, varying by OS. Developers need to either recompile and redistribute their apps to fix this issue or use a patching tool that applies updates without recompilation. However, this tool does not support Linux builds or applications with tamper-proofing or anti-cheat features enabled.
Ransomware attackers stole data in a cyberattack on Union County in Ohio, impacting 45k of the county's 71k residents. The stolen data includes Social Security numbers, driver's license numbers, financial account information, fingerprint data, medical information, and passport numbers.
Phoenix is a Rowhammer attack that bypasses DDR5 protections by reverse-engineering Target Row Refresh (TRR) and exploiting timing windows where defenses weaken. The attack uses dummy memory accesses to trick TRR before executing targeted strikes that can read/write arbitrary memory, steal RSA keys, or escalate Linux privileges within 5 seconds to 7 minutes. It demonstrates that DDR5's protections can still be evaded by sophisticated timing attacks that manipulate memory through carefully crafted access patterns.
Elastic Security Labs provides a comprehensive overview of different attacks and defenses for MCP tools. Elastic provides a prompt for an LLM to detect malicious functions in an MCP server, covering security risks ranging from traditional vulnerabilities to tool poisoning, orchestration injection, rug-pull redefinitions, name collisions, and passive influence. Elastic recommends that users utilize sandboxed environments for MCP, adhere to the principle of least privilege, restrict MCP servers to only trusted sources, require human approval for sensitive operations, and monitor all prompts and code.
Wiz Research developed a data-driven threat hunting methodology to detect anomalous Instance Metadata Service (IMDS) usage by identifying processes that rarely access IMDS but suddenly query sensitive endpoints, such as IAM credentials, leading to the discovery of active exploitation of two zero-day SSRF vulnerabilities. The team uncovered CVE-2025-51591 in Pandoc (HTML-to-PDF conversion via malicious iframe tags) and a ClickHouse SSRF vulnerability where attackers abused SQL "SELECT * FROM url" functions to access cloud metadata services across AWS and GCP environments. This approach demonstrates how behavioral anomaly detection can reveal novel attack vectors targeting cloud infrastructure, emphasizing the importance of enforcing IMDSv2 and implementing least-privilege access controls to mitigate credential theft and lateral movement risks.
Your human analysts will never outpace AI-powered attacks - you're going to have to fight fire with fire. This white paper [11] explain the stages of AI maturity, how they relate to the SOC, and how to approach the human-in-the-loop question. Get the whitepaper from
IAMhounddog is a tool that helps pentesters quickly identify privileged principals and second-order privilege escalation opportunities in unfamiliar AWS environments.
Tokenex is a library that provides a unified interface for obtaining and refreshing credentials from various cloud providers and authentication systems. Tokenex supports AWS, GCP, Azure, OCI, Generic, K8sSecret, OAuth2AC, and OAuth2CC.
There are three critical vulnerabilities in TOTOLINK X6000R routers (CVE-2025-52905, CVE-2025-52906, and CVE-2025-52907) that allow unauthenticated attackers to execute arbitrary commands and bypass security controls via the router's web interface. The vulnerabilities stem from inadequate input sanitization in the cstecgi.cgi endpoint, with the blocklist failing to filter hyphen characters, and enabling argument injection, command injection, and arbitrary file manipulation attacks. TOTOLINK has released patched firmware (V9.4.0cu.1498_B20250826). Users are strongly advised to update immediately as these flaws could allow attackers to gain root access, intercept traffic, and pivot to other network devices.
2025.10.07·
unit42.paloaltonetworks.com·4 min read·TLDR InfoSec
The latest German Chat Control proposals would require scanning of every message, photo, and video on a person's device. Signal has announced that it will discontinue services in Germany, and possibly across Europe, if these controls are passed, arguing that regardless of whether messages are scanned before or after encryption, the controls negate the premises of end-to-end encryption.