Cisco has released security updates for CVE-2025-20352, a high-severity zero-day vulnerability in IOS and IOS XE software that's being actively exploited in the wild. The flaw stems from a stack-based buffer overflow in the SNMP subsystem, allowing authenticated attackers to trigger DoS conditions or achieve root-level code execution on vulnerable devices. Cisco strongly recommends upgrading to patched versions immediately, as no workarounds exist beyond limiting SNMP access to trusted users.
Libraesva has patched CVE-2025-59689, a command injection vulnerability in its Email Security Gateway with a CVSS score of 6.1, after discovering state-sponsored threat actors were actively exploiting it. The flaw can be triggered by malicious emails, allowing attackers to execute commands on the affected system. Organizations using Libraesva ESG should immediately apply the available security update to prevent exploitation.
Attackers created fraudulent GitHub Pages impersonating over 100 companies (including LastPass, 1Password, financial institutions, and tech firms) using SEO to rank high in search results and trick Mac users into downloading fake software installers. The malicious sites redirect victims through multiple layers to ultimately execute a terminal command that downloads Atomic Stealer malware, which harvests credentials and sensitive data from infected systems. The campaign leverages trusted GitHub infrastructure and creates multiple backup repositories under different usernames to evade takedown efforts while targeting a broad range of high-value software applications.
Researchers have discovered a new regular expression (regex) injection method that exploits MySQL's Full-Text Search (FTS) boolean mode operators to bypass input sanitization. This technique utilizes characters like * and +, which have different meanings in FTS versus regex. The attack extracts sensitive data without breaking SQL syntax, demonstrated in CVE-2025-48941 in myBB, where attackers could enumerate deleted thread titles by observing search redirects instead of error messages. This is risky because FTS functions are often unsanitized, as developers don't view them as regular expressions, and the payloads can evade WAFs and security scanners.
L1TF Reloaded is a complex attack chain that uses half-Spectre gadgets to load data into L1 cache and L1 Terminal Fault to read cross-VM secrets via kernel data structures, breaking KASLR and extracting TLS keys. Google responded with Address Space Isolation (ASI), removing sensitive memory from kernel space during VM execution and mapping it during controlled transitions with buffer clearing. The attack highlights how speculative execution vulnerabilities can bypass privilege boundaries in virtualized environments, emphasizing the need for comprehensive architectural defenses beyond piecemeal mitigations.
Palo Alto Networks' Unit 42 linked the Bookworm malware family to the Chinese APT group Stately Taurus by analyzing shared artifacts, including PDB paths, infrastructure, and targeting of Southeast Asian governments. Using the Admiralty System, they scored evidence reliability, reaching a confidence score of 58.4 based on toolsets, victim profiles, timelines from 2015-2022, and environment fingerprints. This case shows how structured attribution enables evidence-based threat actor identification, improving cybersecurity intelligence.
2025.09.25·unit42.paloaltonetworks.com·13 min read·TLDR InfoSec Sponsored
Legacy PAM can't enforce in-session commands, and developers bypass controls that block productivity. Meanwhile, attackers exploit these gaps to escalate privileges and move laterally. StrongDM delivers continuous action-layer authorization [11] across cloud-native and ephemeral environments. Zero standing privilege, protocol-native coverage of 100+ resource types, and just-in-time access that doesn't
ZAPISEC WAF-Copilot is an AI-driven security framework for web applications. It offers a highly configurable and streamlined vulnerability assessment process using AI engines, CVE data correlation and organization, continuous monitoring supported by a database, and a simple, intuitive user interface.
This tool allows server access via WinRM or PowerShell Remoting, with features for capture the flag and penetration testing. It was developed to address limitations in tools like Evil-WinRM and to contribute to open-source security. Devious-WinRM, built on PowerShell Remoting Protocol, uses WinRM but needs fewer permissions, especially in basic Active Directory environments.
Kali Linux 2025.3 introduces ten new security tools, including Caido web security auditing toolkit, krbrelayx Kerberos exploitation framework, and AI-powered tools like Gemini CLI and llm-tools-nmap for LLM-based network scanning. The release adds Nexmon firmware patching framework support for enhanced Wi-Fi capabilities on Raspberry Pi devices, including Pi 5, enabling monitor mode and frame injection for wireless security testing. Additional updates include Kali NetHunter improvements with Samsung S10 support, CARsenal car hacking features with new UI, and experimental Magisk kernel module installation capabilities.
China-nexus threat actor UNC5221 uses BRICKSTORM backdoors on network appliances and VMware infrastructure to maintain persistent access, averaging 393 days undetected. The actor employs sophisticated tactics, including VM cloning to extract credentials offline, credential harvesting via BRICKSTEAL servlet filters, and legitimate tool abuse to access M365 mailboxes and secret vaults. Organizations should inventory unmonitored appliances, hunt for unusual internet traffic from management interfaces, and monitor for VM cloning activities and suspicious SSH enablement on virtualization platforms.
Attackers exploited CVE-2024-36401, a critical GeoServer RCE vulnerability, to breach a US federal agency. They maintained access for three weeks before detection. The threat actors deployed China Chopper webshells, moved laterally to web and SQL servers, and used brute force techniques for privilege escalation and credential harvesting. Organizations should prioritize patching critical vulnerabilities in CISA's KEV catalog and ensure continuous EDR monitoring, as over 16,000 GeoServer instances remain exposed online.
SolarWinds issued a third patch for the critical Java deserialization vulnerability in Web Help Desk, CVE-2025-26399 bypasses CVE-2024-28988, which bypassed the original CVE-2024-28986 flaw. This CVE affects the AjaxProxy component, allowing unauthenticated remote code execution. Trend Micro researchers found each patch bypass. Experts warn that patch bypasses are common with blacklist approaches and predict that this could be exploited, given its history of active exploitation.
CISA issued an alert with eight remediation tips after the Shai-Hulud worm compromised 500+ NPM packages by stealing GitHub tokens and cloud credentials. GitHub responded by enforcing stricter authentication, including mandatory 2FA for publishing and switching to trusted methods with short-lived tokens.
The J Group ransomware gang claims to have breached FAI Aviation Group, a German charter operator, stealing nearly 3TB of sensitive data, including patient records, employee documents, audit files, CVs, and passport copies, and threatening to sell the data after failed ransom talks.
The Department of Homeland Security (DHS) made a viral video with Pokémon images, music, and the "Gotta Catch 'Em All" slogan to promote ICE raids, showing detained immigrants as Pokémon cards and outraging fans who called on Nintendo to sue for unauthorized use.
Sponsored
In experimentation, following conventional best practices will lead to conventional results (or worse). To achieve truly exceptional growth, marketers need to follow a different playbook.
Mischief Marketing is emerging as a strategic response to ad fatigue. By intentionally breaking rules and expectations, marketers are creating campaigns that feel more exciting and fun. Burger King Brazil hijacked Google Maps by uploading coupons to competitors' photo galleries, reaching customers mid-search. Liquid Death leaned into taboos with “Kegs for Pregs,” showing Kylie Kelce drinking from water kegs while visibly pregnant. IKEA Canada texted customers “U up?” between 10 pm and 5 am to promote sleep products, blending flirtation with commerce.
BFCM revenue patterns in 2024 show that the real spike in consumer activity begins only 10 days before Black Friday. While brands often plan for an extended ramp-up, data reveals minimal customer movement in September and October. Instead, there is a sharp and fast climb in browsing beginning mid-November. Product views increase during this short window, but purchases lag behind until Black Friday hits, when orders then surge and browsing drops. Cyber Week is the core revenue period, and after this two-week stretch, both promotional activity and customer engagement taper off quickly.
This playbook outlines how Recall.ai defines a clear problem, builds a targeted lead list, collects proof points, and enriches data manually. Accounts are mapped to key personas, concise email copy is sent, leads are sequenced and qualified, and lists are refined based on responses. A simple data model, weekly cadence, and 14-day sprint plan keep outreach efficient.
Kellanova, the marketer of Pringles, Cheez-It, and Pop-Tarts, built a predictive scoring system that ties creative elements directly to campaign performance. After analyzing over 443 assets across Meta platforms and billions of impressions, the company identified 19 high-impact variables from more than 20,000 creative decisions. Top performing ads featured branding in the first few seconds, positive emotion, product consumption cues, characters, and overlays that reinforced key messages. The system had 83% accuracy in predicting view-through rates and an 11% lift in ROI.
Sponsored
Web traffic gone? You're not imagining things. AI engines really are changing how people find content — and most marketing teams are struggling to adapt. Opticon Online [9] (October 21, free) [9] will be a celebration of what's actually working: Generative Engine Optimization, AI content workflows, and experimentation that moves the
ChatGPT introduced a new “GPT-5 Thinking” option that lets users control how much reasoning the AI applies. Plus, Business/Teams, and Pro accounts now see a dropdown to choose between Standard, which balances speed and reasoning, and Extended, which is slower but deeper. Pro users also get Light for faster output with less reasoning and Heavy for the deepest reasoning at a slower pace.
Gmail's updates shift visibility from timing to engagement. Brands need to separate transactional and promotional streams and remove upsells from service messages to keep them in the right tab. They should also make use of the expanded Manage Subscriptions by offering preference centers, throttling low-engagers, and treating unsubscribes as useful feedback. In the Promotions tab, visibility improves with specific subject lines, clear CTAs, and consistent sender identity. Tracking engagement speed, breadth, and persistence will now matter more than just counting opens.
Fyxer scaled rapidly by blending consumer and enterprise strategies. The product, built to simplify email for non-tech users, requires no setup and rewards users for team invites. Growth started with direct outreach to micro-influencers, followed by performance marketing treated like a DTC brand with viral-style creative and a focus on work email signups. Once enterprise potential was clear, pricing aligned with professional use cases at $30-$50 per user, with seat-based billing under review instead of usage-based models. As the AI improved, Fyxer doubled down on reactivation, targeting early users with founder-style emails and trial restarts to convince skeptics to try again.
Fashion brands often use vague scientific and eco-friendly terms to market products, but many of these claims lack substance and amount to greenwashing. Luxury companies like Gucci and Prada have promoted carbon-neutral or sustainable messaging, yet investigations revealed that these promises often do not match their actual environmental impact, leading Gucci to remove its carbon-neutral claim. The EU Green Claims Directive will require verification before brands can use terms like carbon neutral, eco-friendly, or net zero in campaigns. Despite these regulations, mass production and fast fashion remain unchanged, with companies relying on appealing but empty scientific language to maintain prestige and consumer trust.
Incrementality tests provide stronger starting points for marketing mix models (MMMs), making them more accurate when historic data is limited or missing.
A visual showing that hook, payoff, and action drive a winning brand.
Brands are shifting from casual iPhone-style posts to cinematic short-form films that stand out with higher effort and storytelling.
This article provides a look into the development of Claude Code, a popular AI-powered developer tool that generates over $500M in annual revenue. The tool originated from a simple command-line tool using Claude to identify music, then evolved into a sophisticated product with a tech stack including TypeScript, React, Ink, Yoga, and Bun, with 90% of the code written by itself. Claude Code's success is attributed to its rapid development pace, with features built and shipped in days. The team uses AI agents extensively for code reviews and tests.
2025.09.25·newsletter.pragmaticengineer.com·19 min read·TLDR Web Dev Motion initially chose React Native for its mobile app to use its JavaScript team and share code across platforms, but ran into performance issues when its calendar screen hit 190% CPU usage due to the overhead of bridging between JavaScript and native code. After trying various optimization techniques like caching and lazy loading that only provided marginal improvements, its team rewrote the calendar screen in native code, which reduced CPU usage to just 5%. The company now follows a hybrid approach where new features are built in React Native first for speed, then converted to native code based on performance demands.
Val Town has rewritten and open-sourced its online TypeScript editor from scratch to improve its performance and accuracy. The previous editor ran TypeScript in a Web Worker, which struggled with Deno-specific features and large NPM modules. The new editor uses the official Deno Language Server, running it remotely in cloud containers managed by Cloudflare, resulting in a faster, more reliable experience.
The tech industry is having a shift with anxieties fueled by AI, return-to-office mandates, and layoffs. While leaders can't control these macro trends, they can support their teams by acknowledging the challenging situation privately and validating their team's emotions. Leaders should avoid making empty promises and instead find small, discreet workarounds to make the work environment more livable.
This dev migrated their course platform from a client-server setup (separate React frontend + Hono backend) to TanStack Start to enable server-side rendering (SSR) for better SEO on course, author, and tag pages. They chose TanStack Start over alternatives like creating a separate marketing site with Astro or using TanStack Router's SSR mode because it allows selective SSR while maintaining the option to use more backend features in the future.
Sponsored
If QA is a bottleneck on your software engineering team and you're releasing slowly because of it, you need to check out QA Wolf [10].
Wasmer Edge now fully supports Python via WebAssembly. This allows running popular Python frameworks and libraries like FastAPI, Django, and LangChain directly on Wasmer and Wasmer Edge. It outperforms alternatives like Cloudflare Workers and AWS Lambda by offering better compatibility and faster cold starts without requiring code modifications.
SedonaDB is an open-source, single-node analytical database engine that treats spatial data as a first-class citizen. It is built in Rust and uses Apache Arrow and DataFusion, and it offers full support for spatial types, joins, and functions with optimizations for high performance in single-machine environments. It provides Pythonic and SQL interfaces and integrates seamlessly with GeoArrow, GeoParquet, and GeoPandas for efficient spatial data processing without requiring extensions or plugins.
In Java, the concept of null is ambiguously used to represent both a value and the absence of a value, causing issues in scenarios like partial updates or filtering, where distinguishing between a missing field and a null value is crucial. While Java's `Optional` type aims to address this, it falls short because it cannot represent the explicit null value. The `Omittable` library for Java and Kotlin introduces a container type that distinguishes between a value and the absence of a value without using null as a sentinel, providing a clearer way to handle optional data.
Can a programming language not have booleans? This article goes over replacing booleans with alternatives, and introduces new syntax and evaluation rules for `if`, `else`, `and`, and `or` as binary operators acting on these options/results.
Git can technically be used as a database, though it's not recommended. Git inherently provides versioning, concurrency handling, atomic transactions, and fast data retrieval through its object model of blobs, trees, commits, and references. This article goes over a simple todo application that uses Git's command-line tools, showing how to store and organize data.
Redis and Postgres are compared as caching solutions by building a simple HTTP server and benchmarking read, write, and mixed workloads on a Kubernetes cluster. Redis consistently outperformed Postgres in terms of requests per second and latency, even with Postgres using unlogged tables for faster writes. The bottleneck for Redis was often the HTTP server's CPU, while Postgres frequently maxed out its allocated CPU resources.
Due to changes on YouTube's end, users will soon need to install the JavaScript runtime Deno for yt-dlp to continue downloading YouTube videos using the package.
Apple is increasingly merging iOS and macOS, as shown by Safari's video controls darkening videos on both platforms in recent versions.
Don't use SQL for complex business logic, and instead keep the database as a simple data store while implementing logic within the application code itself.
A seemingly helpful linter suggestion inadvertently introduced a subtle but critical bug by incorrectly applying a standard method within a custom method of the same name, violating Go's error-handling principles and leading to unexpected error equivalences.