Signal's Sparse Post Quantum Ratchet (SPQR) is part of a new "Triple Ratchet" protocol that combines its existing Double Ratchet with quantum-resistant ML-KEM cryptography to protect against future quantum computing threats while maintaining forward secrecy and post-compromise security. The implementation uses erasure coding and state machines to efficiently transmit large ML-KEM keys (over 1,000 bytes) in small chunks, includes a graceful downgrade mechanism for backward compatibility during rollout, and employs formal verification using ProVerif and F* to ensure protocol correctness. Security professionals should note that this represents a practical approach to post-quantum migration, which preserves existing security guarantees while introducing quantum resistance. The protocol automatically upgrades conversations without requiring user intervention.
Modern kernel privilege escalation attacks have shifted from traditional control flow methods like ROP to more stealthy, stable data-only attacks that bypass Control Flow Integrity (CFI), prompting the development of advanced defense systems like VED (Vault Exploit Defense). Novel techniques, such as DirtyPipe, cred-jar heap spray, and pipe primitives, exploit weaknesses in kernel memory handling to corrupt authentication data or page buffers, directly overwriting critical structures, including credential jars and pipe buffers, while evading detection by typical CFI solutions. VED counters these threats through multiple integrity measures, including shadow data tracking, hash monitoring, slab poisoning, and specialized protections for core patterns and pipe buffers, aiming to detect stealthy modifications and strengthen kernel security against increasingly sophisticated data-centric exploits while minimizing performance impact.
Sponsored
When you're running your AI workloads locally, cyber adversaries can target both the physical devices and the models you're running or training. Learn how to mitigate risk [12] by using secure AI PCs and smart endpoint security. Read the ebook by Dell, Intel, CrowdStrike
Gulp is a Python-based incident response platform that accelerates security analysis through high-speed data ingestion from multiple sources, SIGMA rule querying across thousands of detection rules simultaneously, and collaborative investigation features with zoomable timelines for event visualization. The tool leverages OpenSearch and Elastic Common Scheme (ECS) formatting for compatibility while providing scalable multiprocessing capabilities that can grow with organizational needs. Security teams can use Gulp to ingest, query rapidly, and collaboratively analyze security events in a unified platform explicitly designed for incident response workflows.
2025.10.06·workspaceupdates.googleblog.com·3 min read·TLDR InfoSec MokN provides identity protection based on honeypots, with ultra-realistic decoy access points, including VPNs and email servers, that replicate the organization's environment. If an attacker attempts to log in to one of these honeypots using a stolen identity, the security team is alerted and can take appropriate action.
GreyNoise detected a 500% surge in scanning activity targeting Palo Alto Networks login portals on October 3, with over 1,285 IP addresses (93% suspicious and 7% malicious) conducting coordinated reconnaissance that mirrors previous Cisco ASA scanning patterns and shares TLS fingerprints linked to Netherlands infrastructure, potentially signaling upcoming vulnerability disclosures since historical patterns show Palo Alto scan spikes often precede new flaw announcements within six weeks.
CometJacking affects Perplexity's Comet AI browser by allowing attackers to use a malicious link to inject hidden prompts and steal sensitive user data, such as emails and calendars, by exploiting the browser's own access. Experts warn that this demonstrates the broader risks of AI-driven browsers and have urged stricter agent prompt security to prevent future data theft campaigns
Wealthsimple was faced with the common dilemma of having a small security team tasked with reviewing code written by a much larger engineering team in a highly regulated environment. It introduced Semgrep AI to create custom fixes for the specific code under review, augmenting its security team. Semgrep remembers previous decisions on findings and uses that information to auto-triage future findings
2025.10.06·engineering.wealthsimple.com·3 min read·TLDR InfoSec Nearly 800 free VPN apps have serious security flaws, including old Heartbleed bugs, excessive permissions for surveillance, and missing privacy info, posing risks for BYOD policies that should focus on app allowlisting and data protection over just VPN security.
ParkMobile settled a class action lawsuit over its 2021 data breach, which affected 22 million users, by offering victims a meager $1 in-app credit (dispensed as four 25-cent discounts) that must be manually claimed with a promo code and expires in October 2026.
The Trinity of Chaos ransomware group, associated with Lapsus$, Scattered Spider, and ShinyHunters, launched a TOR leak site exposing 39 major firms, including Google, Cisco, and Stellantis, after exploiting Salesforce vulnerabilities via vishing and stolen OAuth tokens, threatening to release over 1.5 billion records if ransoms aren't paid.
Sponsored
Feel like you're drowning in feedback sessions, creative reviews, and stakeholder updates? You're not alone: research from Enterprise Strategy Group shows 78% of employees struggle with meeting overload [4], and 51% regularly work overtime just to catch up
Creator marketing has entered the “Era of Efficacy”. Budgets rose 171% YoY as brands redirect funds from digital advertising to influencer partnerships, with 71% of organizations increasing investment. The focus is on ROI, creator fit, operational maturity, and long-term relationships rather than follower counts. Industry leaders report more than double the ROI by centralizing programs and involving larger teams.
LLMs can make market research faster, cheaper, and more insightful. A hybrid LLM-human approach produced detailed qualitative data and matched humans in identifying key ideas and themes, but showed less diversity and consistency in quantitative responses. With human oversight and company data, LLMs do offer a low-cost way to generate insights across all stages of research.
2025.10.06·thearf-org-unified-admin.s3.amazonaws.com·38 min read·TLDR Marketing Webflow added automated FAQs with schema markup to 6 key feature pages using an AI workflow built in AirOps. The system mined real user questions from Google's “People Also Ask”, Reddit, and niche forums. It then filled content gaps and structured answers for search engines. This led to 331 new AI citations and a 24% lift in SEO impressions, with gains across nearly all tracked queries.
When resending emails to non-openers, include a condition to target only those who have opened one of the last few campaigns. This ensures messages reach engaged recipients and avoids emailing inactive contacts.
This session will discuss evolving attribution models, building more with zero and first-party data sets, and using AI to help separate signal from noise. It takes place on October 23 at 12 pm ET.
Threads is launching public communities that let users join topic-based spaces to share and discuss interests such as basketball, TV, and K-pop. The feature builds on custom feeds and topic tags and is currently being tested across more than 100 popular topics. Each community includes personalized elements like custom Like emojis and public membership listings that appear on user profiles. Threads also plans to add contributor badges and ranking features to highlight top members and surface the most relevant posts.
X Premium posts get far more visibility and engagement than regular user posts. Premium accounts average 10X more reach per post, while Premium+ users see over twice the reach of standard Premium. Engagement rates are higher across Premium tiers at 0.49% to 0.55%, compared to 0% for regular accounts. Text and video posts perform best, while link posts are penalized, especially for non-Premium users.
Focus on writing that drives revenue, not on sounding eloquent. Talk to customers or sales teams to understand pain points, objections, and language. Study competitors' ads to find proven messages and keep a swipe file of strong examples. Specialize in one platform, learn its algorithm, and track ROI.
Gap rebuilt its brand identity by shifting from a mall staple to a cultural storyteller. New leadership focused on creativity and cultural relevance while campaigns with Tyla, Troye Sivan, and KATSEYE connected emotionally and visually with Gen Z. Gap also co-created products with influencers like Julia Huynh and made social content feel organic rather than promotional. The results showed up in sales and earned media.
A 6-slide deck outlining a functional description, problem framework, and value framework.
Top trends include experiential retail pop-ups, gamified AR footwear fittings, and more.
Ideas include collecting reviews, promoting wishlists, and targeting high-intent shoppers with product education.
Sponsored
The second launch of Blue Origin's New Glenn rocket will send two NASA-funded satellites toward Mars to study the processes that drove the planet's evolution from a warmer, wetter world to the cold, dry planet of today. A successful launch would nudge Blue Origin closer to winning certification from the Space Force to begin launching national security satellites. The company plans to recover the New Glenn rocket's first stage booster during the mission.
2025.10.03·arstechnica.com·10 min read·TLDR OpenAI's Sora app saw 56,000 downloads on its first day. It is now ranked third Top Overall app on the US App Store, despite being invite-only and limited to users in the US and Canada. The ChatGPT app and Google's Gemini iOS apps had stronger launches, with each reaching at least 80,000 downloads on day one, but since Sora is invite-only, that may not be a fair comparison. The strong release indicates there is a demand for AI video tools with a social networking-like experience.
2025.10.03·techcrunch.com·4 min read·TLDR Kemmerer, Wyoming, will soon be home to the most advanced nuclear facility in the world. The first-ever Natrium plant, it will bring safe, next-generation nuclear energy. The plant was designed by TerraPower, a company Bill Gates started in 2008. This article looks at the science behind the Natrium plant. TerraPower aims to bring the plant online in 2030.
2025.10.03·links.tldrnewsletter.com·11 min read·TLDR The Earth BioGenome Project (EBP) aims to obtain a genome sequence for every named species of eukaryotic organism on the planet by 2035. Its success will depend on researchers' ability to scale several biotech technologies. Specialists on the front lines of the genomic revolution in biology are confident that such scaling will be possible. Having a genome sequence for every eukaryotic creature will give researchers insights into how evolution proceeded for a myriad of life forms. It could lead to the discovery and development of many drugs, enzymes, catalysts, and other chemicals of incalculable value.
2025.10.03·spectrum.ieee.org·11 min read·TLDR Sponsored
Find out what the world's AI leaders are doing about the most urgent security challenge. The AI Agent Security Summit (Oct 8 / San Francisco) [9] packs _a lot_ into one day: 3 keynotes, 6 lightning talks, and 2 panels; featuring security experts from OWASP, Glean, ScaleAI, Stanford and more. Seats are limited (literally). Save yours
Nishad Singh had confirmation that something illegal was happening at FTX, but he stayed, and now he is facing up to 75 years in jail. A senior engineering member at Pollen is now at the mercy of the UK police with what could be a potential wire fraud case after being asked to run a script that double-charged customers (and then doing so). The Director of Engineering at Frank, a student loan startup, flat out refused to create a fake set of data to pump up customer numbers. Their refusal is what makes them the only example on this list that is totally legally safe.
2025.10.03·blog.pragmaticengineer.com·14 min read·TLDR All servers speaking the AT protocol are part of 'the atmosphere', a web of hyperlinked JSON. Each piece of JSON in the atmosphere has its own at://URI. This post looks at the exact process of resolving an at:// URI. The AT protocol is fundamentally an abstraction over HTTP, DNS, and JSON. It turns the web into a place where content belongs to its creators, not to the apps that display it, by putting users in an authority position, separating identity from hosting, and making data portable.
2025.10.03·overreacted.io·17 min read·TLDR Many tech companies are saying that good help is hard to find. While there is an ample supply of eager and capable engineers for hire, employers say there aren't enough people with the most in-demand skills. Companies are looking for AI-specific experience, but relatively few people have it because the technology is so new. Companies should focus on identifying candidates with transferable skills and let those people learn on the job.
2025.10.03·links.tldrnewsletter.com·7 min read·TLDR Meta has added a new review process for academic papers, sparking internal anger. Yann LeCun, a Turing Award winner and a pivotal figure in modern AI, reportedly considered resigning over the change. The new policy is aimed at aligning pure research more closely with Meta's product road map. It will also help mitigate potential reputational risks from controversial findings. The constant state of reorganization raises critical questions about whether Meta is able to turn its recently acquired assets into a dominant force.
2025.10.03·links.tldrnewsletter.com·5 min read·TLDR Verily, a sister company to Google, develops software and services to help health practitioners advance research and improve patient care.
2025.10.03·bloomberg.com·3 min read·TLDR Most security vulnerabilities come from unnecessary custom code that reimplements what frameworks already do correctly.
2025.10.03·links.tldrnewsletter.com·16 min read·TLDR The share sale allowed current and former employees to sell stock.
Senescence-resistant stem cells, which exhibit greater resistance to age-related stress, are a promising solution when it comes to combating degenerative aging.
Patient are now shouldering responsibility for diagnosing their own symptoms, tracking their own medical data, and ordering their own lab tests.
2025.10.03·links.tldrnewsletter.com·9 min read·TLDR AI tools, from robot toys to homework-grading systems, are flooding classrooms and households in China, providing learning materials along with companionship and emotional support.
2025.10.03·restofworld.org·7 min read·TLDR Sponsored
Generic AI code review catches typos, style issues, and things that _might_ be a problem. Sentry's AI code review [4] (now in beta) catches the bugs that actually take down production.
2025.10.03·sentry.io·Sponsor·TLDR AI OpenAI has reached a $500 billion valuation following a $6.6 billion secondary share sale by employees. It is now the world's most valuable startup despite not yet turning a profit.
2025.10.03·apnews.com·3 min read·TLDR AI Perplexity has officially launched the Comet browser globally after a high-demand beta phase. Comet is an AI-native browser designed to reshape online interaction.
2025.10.03·links.tldrnewsletter.com·2 min read·TLDR AI Former Stripe CTO Rahul Patil has joined Anthropic as chief technical officer, succeeding co-founder Sam McCandlish, who now becomes chief architect. The leadership change aligns with Anthropic's effort to scale infrastructure and product engineering amid rising demand for Claude and competition from Meta and OpenAI.
2025.10.03·techcrunch.com·3 min read·TLDR AI Today's frontier LLM research isn't about building animals, it's about summoning ghosts. Ghosts are a fundamentally different kind of point in the space of possible intelligences, thoroughly engineered by humanity. Over time, we may be able to fine-tune other ghosts more and more in the direction of animals, but it's also quite possible that they diverge even further and end up permanently different. They may end up un-animal-like, but still incredibly helpful and properly world-altering.
2025.10.03·karpathy.bearblog.dev·11 min read·TLDR AI