Search the archive

natural language. Join the beta in Cursor or VS Code

I PORTED JUSTHTML FROM PYTHON TO JAVASCRIPT WITH CODEX CLI AND GPT-5.2 IN 4.5 HOURS

Simon Willison successfully ported the JustHTML Python library to JavaScript using Codex CLI and GPT-5.2 with only a few prompts in 4.5 hours.

A2UI

A2UI is a protocol that lets AI agents generate interactive user interfaces for web, mobile, and desktop applications by sending declarative component descriptions rather than executable code.

SQLIT

Sqlit is a lightweight, user-friendly terminal user interface for fast querying of SQL databases such as Postgres, MySQL, and SQLite.

LETTA CODE

Letta Code is a memory-first coding agent designed for long-lived agents that continually learn and improve across independent sessions.

>> Claim your offer

LIAR'S VALUATION

Startups often mislead employees by inflating valuation revenue metrics like ARR, which can include non-recurring transactions, obscuring true financial health. Equity offers based on these inflated valuations can mislead potential employees about their potential worth. Before joining startups, scrutinize revenue types, valuation structures, and request full financial transparency to make informed decisions.

THE AVERAGE FOUNDER AGES 6 MONTHS EACH YEAR

The average age of founders raising capital increases by six months every year due to AI and B2B industry trends. Older founders dominate AI as they often have PhDs and industry experience. B2B success relies on long-established networks and expertise.

A LITTLE BIT UNCOMFORTABLE

Moving into a leadership role means your relationship with fear shifts. You now have to also help others take risks. Even asking simple questions can be a great starting point to encourage the people you are invested in to push themselves. It is important to learn to spot fear in others so you know when to step in to move things forward.

WHAT'S NEXT AFTER YOU LOSE SOMEONE'S MONEY

After losing an investor's money, founders should follow up with honest self-assessment and feedback requests to preserve relationships and improve future endeavors. Engaging in open communication with past investors can mitigate misunderstandings, demonstrate growth, and possibly spark interest in new ventures. This proactive approach ensures prior investors can accurately represent the founder to new potential backers, maintaining the founder's reputation.

→ CHECK COMPLIANCE NOW [9] ✅ → PREPARE FOR 2026

ZINC

Buy any product online with an API.

QUALGENT

QualGent is an AI-powered QA testing tool that automatically tests iOS and Android apps by understanding app UI and behavior without requiring manual test scripts.

OKARA

Okara is a private AI chat tool that lets users switch between 30+ hosted open-source models with search, file analysis, and collaboration features.

HOW TO SUCCEED AS A SEQUOIA INVESTOR

Ever wondered how Sequoia actually makes investment decisions? Pat Grady and Alfred Lin - recently named as the firm's new stewards - broke it down on Jack Altman's podcast. They go through their voting system, how they track coverage without fake achievement, why they coach investors to stop being afraid of looking stupid, and how to earn founder trust in year one.

THE BIFURCATION IN THE AI MARKET

The AI market has split into two. Enterprises are paying for precision with proprietary models, while consumers are using cheaper open source models for play. Proprietary providers don't need to compete on price because they've won the segment that pays. This is why, despite open source models being significantly cheaper, proprietary providers haven't lost pricing power.

WHAT BECOMES VALUABLE WHEN AI MAKES CREATIVE WORK EASY

AI simplifying creative work raises the value of unique personal experiences and insights.

THE FASTEST-GROWING SOFTWARE VENDORS OF 2025 JUST DROPPED

The Brex Benchmark of the year breaks down the purchasing patterns of Brex's 35,000+ customers to show which vendors are becoming essential for teams to operate and grow.

PERPLEXITY AND NOTEBOOKLM DON'T USE BETTER AI—THEY USE BETTER INTELLIGENCE FLOW ARCHITECTURE

Perplexity and NotebookLM use the same models as everyone else, they just architect the flow of work between human and AI better.

STOP LOOKING FOR SALES MAGICIANS

Successful sales hinge on scalable processes and good salespeople supported by strong inbound leads.

PROMPT INJECTION INSIDE GITHUB ACTIONS: THE NEW FRONTIER OF SUPPLY CHAIN ATTACKS

PromptPwnd is a new vulnerability class that affects GitHub Actions and GitLab CI/CD pipelines that use AI agents like Gemini CLI, Claude Code, and OpenAI Codex. In this vulnerability, untrusted user input from issues, pull requests, or commit messages is injected into prompts, leading to the execution of privileged tools. The attack allows secret exfiltration by tricking AI agents into leaking GITHUB_TOKEN or cloud credentials through shell commands such as gh issue edit. Google's Gemini CLI repository was confirmed vulnerable before the patch. To mitigate this, organizations should restrict AI toolsets, avoid injecting untrusted input into prompts, treat AI output as untrusted code, and limit GitHub token permissions by IP.

PORNHUB EXTORTED AFTER HACKERS STEAL PREMIUM MEMBER ACTIVITY DATA

The ShinyHunters extortion gang is extorting the adult video platform PornHub after stealing over 200M records of personal information in the Mixpanel breach. The breached data includes email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. PornHub stated that they have not worked with Mixpanel since 2021, so the stolen records are historical analytics data from 2021 or earlier.

700,000 RECORDS COMPROMISED IN ASKUL RANSOMWARE ATTACK

Japanese e-commerce and logistics firm Askul suffered a ransomware attack by the RansomHouse group, which exfiltrated data and encrypted its systems, severely disrupting ordering, shipping, and automated logistics operations. Attackers used the compromised credentials to delete backups and deploy file-encrypting malware, exposing over 700,000 records across customers, partners, employees, and executives.

A BROWSER EXTENSION RISK GUIDE AFTER THE SHADYPANDA CAMPAIGN

The ShadyPanda campaign compromised popular Chrome and Edge extensions after seven years of building trust, affecting 4.3 million users, and installed full RCE frameworks that could steal session tokens and hijack SaaS accounts, bypassing MFA. The attack demonstrated that browser extensions represent a critical blind spot between endpoint and cloud security, with silent auto-updates enabling overnight weaponization. Organizations should implement extension allow lists, treat extension permissions as OAuth access grants, conduct regular permission audits, and monitor for behavioral changes that indicate compromise.

WHAT DATA DO CODING AGENTS SEND, AND WHERE TO?

As AI coding agents become more common, security teams should understand what data these tools collect and where it goes. Chaser Systems created a test environment with seven coding agents, testing actions such as starting the agent, tab autocomplete, creating new features, committing and pushing to a git repository, running tests, and uploading data to 0x0.st. They also checked access to AWS credentials and files outside the project directory. The article describes the domains contacted, sample requests, and data transfer volumes during tests conducted with telemetry both disabled and enabled, including scenarios where telemetry is enabled, but FQDNs are blocked.

JUMPSHOT: XM CYBER UNCOVERS CRITICAL LOCAL PRIVILEGE ESCALATION (CVE-2025-34352) IN JUMPCLOUD AGENT

A critical flaw was found in the JumpCloud Remote Assist for Windows agent that lets any low-privileged user on a machine gain full SYSTEM-level control or crash the system entirely. The issue stems from the agent's uninstaller performing file creation, deletion, and execution in the user's %TEMP% directory, which an attacker can redirect using symbolic links and mount points to target protected system files. This enables both denial-of-service via driver corruption and full local privilege escalation through a race condition involving Windows Installer files, making rapid patching to version 0.317.0 or later essential for organizations using JumpCloud-managed Windows endpoints.

removes malicious calendar invites. Register today

ANNOUNCING XINT CODE

Theori's Xint Code, an AI-powered code analysis tool, discovered critical 0-day RCE vulnerabilities in Redis, PostgreSQL, and MariaDB with zero human intervention at ZeroDay Cloud, sweeping the database category and outperforming all human teams. The tool analyzes source code, configuration files, and binaries without packaging or harnessing requirements, producing actionable reports with dramatically fewer false positives than traditional static analysis while identifying vulnerabilities missed by humans for decades. Theori is seeking early partners to validate findings on real codebases before broader rollout.

SQ

sq is a CLI that provides jq-style access to structured data sources such as SQL databases or document formats like CSV or Excel.

ECHO (PRODUCT LAUNCH)

Echo uses AI agents to create and maintain vulnerability-free Docker base images by stripping non-essential components, reducing attack surface, and continuously patching newly discovered flaws. These CVE-free images drop into existing workflows by changing a single Dockerfile line, instantly lowering container vulnerability counts.

SVG FILTERS - CLICKJACKING 2.0

A novel clickjacking technique leverages SVG filters applied to cross-origin iframes to read pixel colors, hide or manipulate UI elements, and execute logic gates for complex multi-step attacks without JavaScript. The technique enables data exfiltration through fake captchas, dynamic attack overlays that respond to iframe state changes, and even QR code generation to encode stolen data for mobile exfiltration. Security teams should note that traditional X-Frame-Options and CSP frame-ancestors remain the primary defenses, as this attack only works against frameable pages.

NO, SOUNDCLOUD HASN'T STARTED TUNING OUT VPNS. IT'S MOPPING UP AFTER A CYBERATTACK

SoundCloud detected unauthorized access to an internal dashboard, triggering incident response and outside forensics support. Attackers accessed email addresses and public-profile data for roughly 20 percent of users, but no passwords or financial information. The company also faced web-only DDoS attacks, and later configuration changes accidentally disrupted some VPN users, sparking false rumors that SoundCloud was banning VPN access.

SANTASTEALER IS COMING TO TOWN: A NEW, AMBITIOUS INFOSTEALER ADVERTISED ON UNDERGROUND FORUMS

SantaStealer is a new malware-as-a-service info‑stealer advertised in Telegram channels and forums that can exfiltrate documents, credentials, crypto wallets, and other sensitive data from numerous applications. It uses a modular, multi-threaded design that runs mostly in memory. The software gathers data from browsers, messaging apps, and gaming platforms, zips everything, splits it into 10 MB chunks, and sends it over unencrypted HTTP to attacker-controlled servers.

COUPANG CEO STEPS DOWN AFTER DATA BREACH HITS 33.7 MILLION USERS

South Korean e-commerce giant Coupang's CEO resigned following a data breach that exposed 33.7 million customer accounts.

AMAZON DISRUPTS RUSSIAN GRU HACKERS ATTACKING EDGE NETWORK DEVICES

Amazon Threat Intelligence disrupted Russian GRU hackers (linked to Sandworm/APT44) who shifted from vulnerability exploitation to targeting misconfigured edge devices like routers and VPN gateways for credential theft against Western critical infrastructure.

MICROSOFT TO BLOCK EXCHANGE ONLINE ACCESS FOR OUTDATED MOBILE DEVICES

Microsoft will block mobile devices running Exchange ActiveSync versions below 16.1 from connecting to Exchange Online starting March 1, 2026.

See how it works

SOCIAL MEDIA PREDICTIONS 2026

Social media and branding will focus on tastemaking and radical personalization next year. Brands will adopt “spam” accounts to share unpolished, slow content. Creators will take real ownership in brands as Chief Creative Officers or shareholders. Immersive third spaces like cafes and pop-ups will build community. A revival of 2016-style moodboard aesthetics, updated for Gen Z, will emphasize maximalist individuality and nostalgia. Brands that let people co-create, remix, and play with personalized experiences will thrive.

COMPANIES ARE DESPERATELY SEEKING ‘STORYTELLERS'

Corporate America is hiring more storytellers to shape brand narratives across blogs, podcasts, social media, and events. There is a shift from traditional media to direct audience engagement. These roles go beyond copywriting, blending communication, marketing, and real-world experiences to connect with customers, investors, and employees. Demand for storytellers has doubled on LinkedIn, with companies seeking authenticity and human relatability as audiences grow wary of AI-generated content. Brands now prioritize original content creation internally to maintain control over their messaging.

HOW TO BE COMPETENT VS FUN ON SOCIALS

Follower growth depends on whether the audience wants information or entertainment. When people seek information, balanced content builds credibility and drives follows, as Yelp accounts with 3 to 4 star ratings gained up to 105.5% more followers than overly positive ones and up to 500% more than consistently negative ones. When people seek entertainment, highly positive content performs best and drives up to 116.3% more followers on average. Brands focused on sales should match tone to intent, since friendly and genuine content converts better even when credibility signals like verification are present.

6 PIECES OF ADVICE TO BUILDING YOUR PERSONAL BRAND ON LI

Building a personal brand on LinkedIn is about owning your story, not your job. Start by commenting thoughtfully on others' posts to leverage existing audiences, then mix personal and work stories in your own posts to show vulnerability. Capture ideas as they come to avoid writing cold, and use tools to simplify content creation. Be approachable and relatable rather than overly polished. Make sure your profile reflects your personality and story. Consistency matters more than perfection.

customers only). Sign up to secure your discount