Search the archive

SYND'S COMMUNITY-FIRST LAUNCH BREAKS RECORDS

The launch of SYND on Aerodrome has attracted unprecedented participation with over $60M in voting power within 4 days, making it the 4th largest pool by votes.

BANK OF ENGLAND PROPOSES £10K–£20K STABLECOIN CAP

The Bank of England is considering a cap on individual stablecoin holdings, restricting ownership to £10,000–£20,000 per person to mitigate systemic risk.

BITCOIN WHALE CONTINUES SELLING BTC AFTER $4B ETH ROTATION

The whale that swapped over $4B in BTC for ETH in August has resumed selling, moving 1,176 BTC ($136M) to Hyperliquid across two transactions.

RUMOR: SMALLER DYNAMIC ISLAND BUT NO UNDER-SCREEN FACE ID FOR IPHONE 18

The iPhone 18 is rumored to debut a slimmer, narrower Dynamic Island, marking its first design change since the iPhone 14 Pro. While it won't yet adopt under-screen Face ID or a hidden front camera, the refined shape would make the cutout less visually dominant. This adjustment pushes Apple closer to its all-screen design goal and offers a cleaner look that frees up more space for both the display and status bar.

HIGGSFIELD: $50 MILLION SERIES A RAISED TO TRANSFORM AI VIDEO CREATION

Higgsfield.ai raised $50 million in Series A funding led by GFT Ventures to advance its AI video creation platform. The company has gained 11 million users and 1.2 billion social media impressions in five months since launch, outpacing competitors with its Click-to-Video technology that creates cinematic clips with a single click. The funding will support enterprise platform expansion, team growth, and accelerated market strategy in the $600 billion short-form video market.

MIDJOURNEY'S STYLE EXPLORER V1

Midjourney launched an early version of its style explorer that features thumbnails that show prompts rendered with different SREF codes sampling from the continuous latent space of styles. Users can save their preferred styles, try out styles with custom prompts by hovering, and use fuzzy search to find styles matching descriptors like "photographic" or "anime." The tool allows rapid style experimentation by applying different visual aesthetics to the same prompt across multiple variations.

EVERYONE WANTS A FASTER HORSE. WE AIM TO PLEASE

Perception often shapes value and experience more strongly than objective improvements. Since user-reported data is biased and incomplete, blending attitudes, behaviors, and latent knowledge offers deeper insights. Examples like Starbucks' handcrafted image, eco-friendly dish soap, and GE's playful MRI rooms show how subtle, perception-driven design can create more meaningful and empathetic outcomes.

WHY JAGUAR'S RIGHT TO STICK TO ITS CONTROVERSIAL REBRAND

Jaguar's controversial rebrand, launched with bold concept cars in striking colors, deliberately distanced the brand from traditional buyers to target a younger, wealthier, design-focused audience. While sales have dipped, Jaguar is embracing exclusivity with cars priced over $130,000. It claims that rising interest among high-income and younger consumers is proof that the polarizing strategy is working.

LESSONS LEARNED IN AI AND DESIGN WORKFLOWS

A Dropbox product designer shares insights from experimenting with AI tools like Figma Make and Cursor. They found that while these tools show promise, the gap between design and engineering remains significant. AI tools actually expose design system weaknesses rather than hiding them, making strong foundational systems more critical for successful implementation. The key to meaningful AI adoption lies in having internal champions who provide resources and support for experimentation. Critical thinking remains essential, as AI outputs still lack crucial context about product strategy and user insights.

ALL-IN-ONE AI GENERATOR

PXZ AI is your all-in-one free AI creative platform, excelling in video generation and graphic design.

CURATED SET OF FUTURISTIC UI COMPONENTS

Cosmic UI is a set of beautifully-designed sci-fi components with customizable SVG shapes. Built for modern frameworks with accessible interactive logic.

TRANSFORM YOUR PICTURE TO DRAWING IN SECONDS

Use AI to transform any picture into pencil sketches, watercolor paintings, and artistic drawings.

SEVEN IPHONE AIR DETAILS YOU MIGHT'VE MISSED

Apple's new iPhone Air pushes design into ultra-thin territory but comes with notable trade-offs. Its Dynamic Island sits deeper into the display to accommodate packed components, the USB-C port is off-center, and the phone uses a single rear camera and mono speaker, giving it a more minimal—but compromised—look. These changes create a sleeker silhouette overall, but at the cost of symmetry, audio fullness, and advanced camera design.

SMASH TAKES DOWN WETRANSFER IN THIS CHEEKY BUT CLEVER CAMPAIGN

Smash capitalized on WeTransfer's AI-related backlash with a cheeky, humorous campaign positioning itself as the ethical alternative. By emphasizing user privacy, intellectual property protection, and transparency—including showing the environmental cost of transfers—Smash attracted a surge of new users globally. The campaign proves that well-timed humor combined with genuine values can turn a competitor's misstep into a major growth opportunity.

HOW LEADING AGENCIES ARE NAVIGATING THE NEW ERA OF BRAND STORYTELLING

Three leading agency executives discussed how modern brand storytelling has evolved beyond traditional content creation to become an integral part of brand building across multiple channels and formats. Agencies are evolving from simple content creators to strategic partners, collaborating closely with increasingly capable in-house teams. They focus on modular content systems that serve business objectives rather than just creative expression. AI should be embraced as a creative enhancement tool that accelerates ideation and removes barriers, while agencies must also adapt their content strategies for AI-powered search engines that prioritize clear, authoritative answers to audience questions.

EXPERT TIPS ON GETTING INTO CREATIVE FLOW (AND STAYING THERE)

It is important to work with natural energy rhythms and create dedicated time slots for deep work.

THE BIGGEST REDESIGN FLOPS OF ALL TIME

Cracker Barrel's recent logo redesign sparked such fierce consumer backlash that the company immediately reverted to its original design and suspended a $700 million rebrand plan.

works

Choose "none of the above" with ThreatLocker Patch Management.

Their Cyber Hero Team pre-tests every single update in a controlled environment [4]. You get the security benefits of up-to-date software, without the hassle. And you're always in control with Centralized management across all endpoints and policy based-deployment.

NEW VOIDPROXY PHISHING SERVICE BYPASSES MFA ON MICROSOFT AND GOOGLE ACCOUNTS

VoidProxy is a new Phishing-as-a-Service platform that uses Adversary-in-the-Middle attacks to bypass multi-factor authentication on Microsoft and Google accounts by intercepting login credentials and session cookies in real-time. The platform leverages compromised email accounts from legitimate providers like Constant Contact to evade spam filters, then redirects victims to perfect clones of login pages where all authentication data is stolen. VoidProxy operates with a sophisticated two-part infrastructure that features disposable front-ends and resilient back-ends, along with anti-analysis features including Cloudflare CAPTCHA protection, making it difficult for security teams to detect and track.

ETERNAL-TUX: CRAFTING A LINUX KERNEL KSMBD 0-CLICK RCE EXPLOIT FROM N-DAYS

A stable authenticated 0-click remote code execution exploit against Linux's kernel SMB3 daemon (ksmbd) chains two existing CVEs: CVE-2023-52440 for controlled heap overflow, and CVE-2023-4130 for memory leakage, targeting Linux 6.1.45 with full mitigations enabled. The exploit leverages NTLM authentication flaws to overflow a 512-byte SLUB allocation, then uses an arbitrary free primitive to corrupt a 1KB ksmbd_conn object and hijack a vtable pointer to achieve ROP-based code execution via call_usermodehelper. The technique demonstrates how N-day vulnerabilities can be chained together for reliable exploitation despite modern kernel protections, though it requires authenticated SMB access and is limited by the relative rarity of ksmbd deployments in production environments.

INSIDER BLAMED FOR FINWISE DATA BREACH AFFECTING NEARLY 700K

Nearly 700,000 FinWise Bank customers are being notified after a former employee may have accessed or taken personal data post-employment. The breach, detected over a year after it happened, involved customers from American First Finance. FinWise is offering affected individuals free credit monitoring. The case highlights ongoing risks posed by insider threats within financial and tech organizations.

OLD BUT GOLD, DUMPING LSASS WITH WINDOWS ERROR REPORTING ON MODERN WINDOWS 11

A red team researcher demonstrated how to bypass LSASS memory protections on Windows 11 by exploiting a vulnerable version of WerFaultSecure.exe from Windows 8.1, which runs with the highest Protected Process Light (PPL) level and can access protected LSASS memory that normal processes cannot touch. The technique uses undocumented parameters to trigger unencrypted crash dumps of the LSASS process, then disguises the output file with PNG magic headers to evade antivirus detection. The attack requires deploying the older vulnerable WerFaultSecure.exe binary alongside a custom loader that launches the tool with proper PPL protections, demonstrating how legacy Windows components can be weaponized against modern security controls.

HACKING THE XBOX 360 HYPERVISOR PART 1: SYSTEM OVERVIEW

This is the first part of a three-part series on hacking the Xbox 360 hypervisor. It provides a comprehensive system overview of the console's security architecture, including the custom Xenon PowerPC CPU with on-die security features like 768 eFuses, 64KB secure RAM, hardware encryption, and protected memory pathways that use per-boot encryption keys and CRC checksums. The hypervisor operates as a 256KB protected process that manages all executable memory allocation and code authentication, with only one known exploit in its history - the "4548 system call handler bug," which was likely caused by a compiler optimization error rather than intentional code changes. In the console's robust security model, where Microsoft must sign all code, hypervisor memory is protected with both encryption and integrity checks. The system uses multiple privilege levels with strict validation to prevent software-only hacks.

PLAYING WITH HTTP/2 CONNECT

HTTP/2 CONNECT is an upgrade over the original HTTP/1 CONNECT method, shifting from tunneling entire TCP connections to multiplexing multiple streams within a single connection. This evolution enables more efficient proxying and port scanning by allowing numerous tunnels without the overhead of opening many separate TCP sessions. The protocol's design incorporates features like HPACK header compression and support for modern proxy use cases—including WebSocket, UDP, and raw IP proxying—making it highly relevant for security research and next-generation proxy infrastructure.

private CTF

RAW DISK PARSER

Raw Disk Parser is a proof-of-concept Python script that dumps sensitive or restricted files without triggering alerts. It works by reading directly from the disk, then analyzing NTFS filesystem structures to find and read files. This method doesn't use standard Windows file APIs, so it effectively bypasses file access controls, locks, and some EDR/AV monitoring features that rely on hooking high-level file I/O operations.

SECURITY ONION 2.4

Security Onion is a free and open platform built by defenders for defenders. It includes features like network visibility, host visibility, intrusion detection honeypots, log management, and case management. In the latest 2.4 release, there are new features like SOC for UniFi dashboard, JA4 support, and many bugfixes.

GEORDIE (PRODUCT LAUNCH)

Geordie provides enterprises with real-time visibility and alerts for AI agents, helping organizations track agent actions, detect unexpected behaviors, and securely manage AI agent adoption and risks.

SCATTERED SPIDER RANSOMWARE GROUP ABRUPTLY DECIDES TO END OPERATIONS - FOR NOW, AT LEAST

Fifteen major ransomware gangs, including Scattered Spider, Lapsus, and Shiny Hunters, announced they are "going dark" after claiming they fulfilled their goals and will enjoy their earnings from recent attacks on companies like Jaguar Land Rover, Marks & Spencer, and Salesforce. They posted their farewell on BreachForums, saying they will stop attacking in their name. However, experts doubt this will be permanent, as some members have already been arrested, and the profits of cybercrime may lure them back. The announcement follows a summer campaign where the rebranded "Scattered Lapsus Hunters" targeted over 700 organizations worldwide, mainly through social engineering and data theft rather than ransomware.

FBI WARNS OF UNC6040, UNC6395 HACKERS STEALING SALESFORCE DATA

The FBI issued a FLASH alert about cybercriminal groups UNC6040 and UNC6395, which target Salesforce to steal data and extort through methods like voice phishing and OAuth token exploitation. UNC6040 has used social engineering since late 2024 to trick call center staff into connecting malicious apps to Salesforce, while UNC6395 exploited OAuth tokens in August to access customer data and credentials. Major companies such as Google, Adidas, Qantas, Cisco, Louis Vuitton, and Tiffany & Co. have been impacted. The threat actors are linked to ShinyHunters and Scattered Spider, who recently announced they are "going dark."

PROTON MAIL TAKES ACTION: JOURNALIST ACCOUNTS SUSPENDED FOLLOWING CYBERSECURITY AGENCY REQUEST

Proton Mail suspended two journalists' accounts after they published research documenting an intrusion into several South Korean government institutions in Phrack. It contacted the researchers via the disclosure account a week after the print release, notifying them that their account was being suspended, citing a policy violation due to a government cybersecurity organization. The company reversed its decision and restored the accounts following a public outcry over privacy.

production. DOWNLOAD TAG REPORT FROM INVICTI

SIDEWINDER APT LEVERAGES NEPAL PROTESTS TO PUSH MOBILE MALWARE

Hackers exploited Nepal protests by masquerading as emergency services and officials to trick people into downloading malware and stealing data.

FAIRMONT FEDERAL CREDIT UNION DATA BREACH HITS 187,000 IN WEST VIRGINIA

Fairmont Federal Credit Union has informed over 187,000 individuals about a security breach in 2023 that exposed sensitive information, including financial, medical, and personal data.

GOOGLE CONFIRMS HACKERS GAINED ACCESS TO LAW ENFORCEMENT PORTAL

Google confirmed hackers from the "Scattered Lapsus$ Hunters" group created a fraudulent account in its Law Enforcement Request System (LERS), used worldwide by police to submit data requests, though no requests were made and no data accessed before the account was disabled.

→ Get The Loop Playbook

KEY TAKEAWAYS: HOW PEOPLE ARE USING CHATGPT

ChatGPT adoption is broadening globally and creating value in both work and personal life. Gender gaps have narrowed, with women now making up more than half of identified users. Growth is fastest in low and middle-income countries. Most use centers on everyday tasks like seeking information, writing, and planning, while coding and self-expression remain smaller segments. About half of interactions are advisory “Asking”, 40% are task-oriented “Doing”, and 11% are reflective “Expressing”. Roughly 30% of usage is work-related and 70% non-work.

ADVERTISING IN 2030

Confidence in gen AI as a creative tool is rising, while VR, AR, and the metaverse have failed to gain widespread adoption. Consumer priorities have shifted back toward price over sustainability. Workplace communication remains more digital than pre-2020, but many companies have returned to in-person interactions. Advances in AI, biometrics, personalization, and bot-to-bot marketing are expected to continue, while global coordination on privacy and lasting changes in consumer behavior are seen as unlikely.

FROM MINIMAL TO WHIMSICAL: HOW WE REDESIGNED USERLIST IN 2025

Userlist launched a major redesign in September after outgrowing its minimalist interface from 2019. The update introduced vertical navigation, denser layouts, smaller fonts, and improved access to assets like segments and profiles. The team added whimsical illustrations, a new logo with intertwined U letters, and consistent microcopy and capitalization rules. The redesign also included a full refresh of documentation and the marketing website, with new modules, screenshots, and layouts.

REDDIT LEARNINGS FROM 3 MONTHS OF TESTING

After 3 months on Reddit, lemlist gained 22% more traffic and 20% higher conversions but lost posts to deletions and account flags. Each subreddit has its own rules, moderators cut anything that feels promotional, and automation backfires. The only way to win is with authentic, native participation. Reddit doesn't drive quick leads, but strong threads do boost SEO and AI visibility.

SEO + PAID TIP: USE VECTOR EMBEDDINGS TO REDUCE WASTE AND CLOSE TOPIC GAPS

Holistic strategies that unify Paid and Organic data expose where you're overspending or under-investing across the funnel. Export your search terms from Google Ads and Search Console, embed both sets of keywords using a text-embedding model, calculate vector distances between each Paid keyword and its nearest Organic neighbor, then identify gaps.

THE 6 FRAMEWORKS YOU NEED FOR 2026 PLANNING

GTM OS delivers a structured approach by guiding leadership teams through the 5 Valleys, 3 Ps, 15 GTM Problems, and 8 Core Questions every quarter. This process uncovers where growth is breaking down, validates whether platform and product-market fits still hold, and isolates the top 3 or 4 priorities for the next 90 days. By anchoring planning conversations in these frameworks, leaders replace ad hoc, reactive decisions with an actionable roadmap.

AI PROMPT ENGINEERING TO WORK SMARTER, NOT HARDER

Meta prompting helps you reverse-engineer effective prompts to save time, while basic prompting rules, such as assigning roles and giving clear instructions, improve output quality. Teaching AI a specific voice and tone allows for more authentic communication, and asking it to slow down produces more accurate and thoughtful responses. Other methods include the AI sandwich, where humans draft, AI expands, and humans edit, and fill-in-the-blank prompting to complete unfinished writing.

FROM GHIBLI TO NANO BANANA: HOW AI TOOLS BECOME CULTURAL PHENOMENA

Nano Banana went viral after its August launch, gaining 10M users and powering 200M image edits within weeks. It runs 2-3X faster than GPT-4o. Growth came from frictionless onboarding, share-optimized outputs, and cultural timing. The trend highlights how consumer AI adoption pushes enterprise uptake and raises expectations for speed, simplicity, and virality in product design.

HOW DO KIDS SPEND THEIR SCREEN TIME?

Video dominates kids' screen time, making up 60% of usage for children under 9, with gaming adding another 26%.