Search the archive

GEMINI BATCH API NOW SUPPORTS EMBEDDINGS AND OPENAI COMPATIBILITY

The Gemini Batch API now supports the newly launched Gemini Embedding model and the ability to leverage the OpenAI SDK to submit and process batches.

JPMORGAN: S&P 500 REJECTION OF STRATEGY A SETBACK FOR CRYPTO TREASURIES

The S&P 500 committee's decision to reject Strategy's inclusion despite meeting criteria is a “blow to crypto treasuries,” signaling reluctance to add firms that function as bitcoin funds. The move limits Strategy's ability to channel bitcoin exposure into major benchmarks, raising the risk that other index providers could also reconsider. Analysts warned that fatigue is growing around treasury-focused firms, with capital potentially shifting instead toward exchanges and miners with operating businesses.

SEC CHAIR CALLS FOR CLEAR RULES TO UNLOCK ONCHAIN CAPITAL RAISING

SEC Chair Paul Atkins said entrepreneurs and investors should be able to raise capital onchain “without endless legal uncertainty,” reaffirming that most crypto tokens are not securities. He outlined “Project Crypto,” aimed at modernizing securities rules to enable onchain trading, lending, and staking under a unified framework. Atkins criticized the prior administration for driving innovation offshore and said the new SEC approach is to provide the “minimum effective dose” of regulation to protect investors while fostering growth.

INTRODUCING THE X402 BAZAAR

Coinbase's x402 is an open payments standard that allows any online service to be monetized and paid for via crypto-based microtransactions. The x402 bazaar enables dynamic, self-improving agents that can browse before they pay, which unlocks complex workflows that previously required developers to directly sign up and pre-pay for services like LLM inference, financial analysis, and web scraping.

UPBIT EXCHANGE LAUNCHES ETHEREUM L2

Upbit, the largest South Korean crypto exchange, has launched its Giwa layer 2 on testnet. The layer 2 is built on the OP stack and aims for one-second block times and a friendly user experience. Details about the mainnet launch, ecosystem partners, and explicit purpose of the chain remain unclear, but this is the latest in a flurry of L2 announcements from major entities like Sony and Robinhood.

MARKETS NEED RULES, AND CRYPTO IS NO DIFFERENT

Crypto markets require clear regulatory frameworks to achieve broad adoption, countering both the "regulatory free-for-all" approach favored by some crypto advocates and the current hostile regulatory environment. There are four essential objectives for crypto regulation: predictability and stability, protection of property rights, transparency and information clarity, and fair competition. The SEC's approach of pursuing enforcement actions without first establishing clear legal standards creates uncertainty that stifles innovation while allowing bad actors to operate in regulatory grey zones. Crypto-specific regulation should recognize blockchain technology as both a financial system and a web infrastructure platform, requiring specialized frameworks like token taxonomy, decentralization standards, and guidelines that enable legitimate businesses to operate without fear of arbitrary prosecution.

THE BOROS FUNDING RATE TRADE

Boros is a new Pendle-built platform that enables direct trading of funding rates rather than underlying assets or perpetual contracts. The strategy, called "Optimistic Funding Rate Trading," involves longing rates when Binance's real-time funding rate rises above the market's implied rate and shorting when it falls below, attempting to capture both settlement gains and price movements from rate shifts. The approach relies on timing market sentiment cycles in funding rates, with traders earning the spread between actual funding settlements and their locked-in fixed rate, plus potential profits from correctly anticipating rate direction changes. This is high-risk in nature, and there is potential for significant losses from mistimed entries or misjudged market shifts.

FROM WORLD COMPUTER TO GUARANTEE MACHINE

A developer building a real-time fitness aggregator demonstrates why blockchains are fundamentally unsuitable for most applications by detailing how a simple Python app becomes impossible to implement onchain. The app easily handles continuous data streams, event-driven updates, external API calls, real-time processing, and hot deployments using traditional web infrastructure, but each capability is blocked by blockchain constraints like determinism requirements, oracle dependencies, gas costs, and sandboxed execution environments. Blockchain applications remain toy-like because they're designed around extreme blockchain limitations rather than actual user needs. A new approach is needed to bridge the gap between computational requirements and verifiable guarantees.

BASTION PROPOSES TO ISSUE HYPERLIQUID'S USDH STABLECOIN

Bastion, a regulated stablecoin issuer with a New York trust charter and broad MTL coverage, has submitted its proposal to issue Hyperliquid's native USDH. Unlike other contenders, Bastion doesn't run a competing chain or stablecoin, positioning itself as a neutral infrastructure partner with strong U.S. regulatory compliance. The proposal calls for USDH to be a full-stack stablecoin with segregated, bankruptcy-remote reserves, 95% of yield reinvested into Hyperliquid growth, and global on/off-ramp access via partners like Rain, LayerZero, and Securitize. Bastion argues USDH should serve as the base stablecoin for the ecosystem, with others built on top of it rather than as wrappers.

PENDLE HITS ANOTHER ATH

Pendle has seen an exponential growth in TVL, with a new record high of $11.3 billion, up 250% since May.

POLYGON HARD FORK FIXES FINALITY BUG BEHIND TRANSACTION DELAYS

Polygon Labs confirmed it successfully deployed a hard fork to fix a finality bug on its PoS chain that caused 10-15 minute delays in validator synchronization and transaction confirmations.

SYNDICATE TO LAUNCH TOKEN VIA AERODROME'S COMMUNITY-FIRST MODEL

Syndicate is launching its $SYND token on Aerodrome using the platform's community-first model, where 1% of supply is deposited as voting incentives before liquidity exists.

COINBASE ONE EXPANDS ONCHAIN BENEFITS WITH NEW PARTNERS

Coinbase One members have already earned $1M+ in onchain rewards since the program launched.

APPLE'S INTRO SPECIFICALLY PAYS TRIBUTE TO THE JOBS+JONY IVE ERA OF DESIGN (AND IGNORES THE VISION PRO)

Apple's September event opened with an unusual 90-second tribute to the Jobs and Jony Ive design era that showcased iconic design elements across Apple's product lineup. The homage notably excluded meaningful coverage of the Vision Pro, showing only a brief one-second shot of its crown despite the headset representing a significant design investment. The tribute also unusually highlighted Apple Store architecture worldwide, suggesting the company wanted to celebrate its design legacy spanning both products and retail spaces.

ADOBE AT IBC 2025: INTRODUCING MORE THAN 90 NEW EFFECTS, TRANSITIONS, AND ANIMATIONS IN PREMIERE PRO

Adobe unveiled Premiere Pro and After Effects v25.5 at IBC 2025, introducing over 90 new effects, transitions, and animations from its Film Impact acquisition. The updates focus on workflow improvements, including smoother zooming, faster playback, and enhanced navigation based on extensive community feedback. These refinements aim to reduce friction in daily editing tasks while providing creators with expanded creative tools at no additional cost.

NEW EMOJIS WILL INCLUDE BIGFOOT, ORCA WHALE, TREASURE CHEST, AND MORE

The Unicode Consortium has announced its next batch of emojis, arriving next year, including a trombone, treasure chest, bulging-eyes face, fight cloud, apple core, orca, gender-neutral ballet dancer, landslide, and Bigfoot. The update will also expand skin tone options for multi-person emojis, such as dancers and wrestlers.

HOW TO BUILD A RESILIENT DESIGN TEAM

Figma design manager Jonas Downey outlines seven strategies for building resilient design teams that can adapt to rapid technological changes and high-pressure environments. Key approaches include prioritizing team health through open communication and realistic workloads, encouraging experimentation across traditional role boundaries, and treating craft as a competitive differentiator. Downey emphasizes building cross-functional bridges, implementing just enough process to avoid stifling creativity, scaling teams intentionally rather than filling headcount, and incorporating levity to maintain team morale during challenging periods.

DESIGN X AI: PROVING WHAT'S POSSIBLE

A working AI-powered proof of concept was created in one hour using Cursor and Figma MCP after stakeholders doubted the technical feasibility of a brand expression feature idea. The prototype automatically extracts brand colors from any website, converts low-quality logos into crisp SVG vectors, and previews different color combinations for brands. It shows how modern design leaders must be hands-on with AI tools and technical building to lead teams and collaborate with engineering effectively.

“TAKE YOUR PLEASURE SERIOUSLY”: WHY JOY SUSTAINS SERIOUS WORK

Design can ease workplace mental strain not just by function, but by perception and delight. Research like the Hitachi ATM study (aesthetic–usability effect) and NASA's Task Load Index show that attractive, simplified designs reduce cognitive load, while examples from Asana, Slack, and the Eames Office illustrate how small sparks of joy and playfulness make tools feel more human and manageable.

TRANSFORM YOUR TEXT DESCRIPTIONS INTO STUNNING VISUAL ARTWORKS

Generate beautiful, high-quality images using advanced AI models. Create unique artwork, photos, and designs with simple text descriptions.

YOUR TIKTOK SLIDESHOW FACTORY

Create, edit, and upload TikTok slideshows in seconds with AI. Drive traffic to your business with automated TikTok marketing.

THE FIRST 30 SECONDS: HOW TO SHOW VALUE IN AI PRODUCT ONBOARDING

AI product onboarding should prioritize personalization and immediate value delivery over traditional feature walkthroughs, with 80-90% of trials occurring on Day 0, making those first moments critical. Effective flows start with simple questions, build context-aware personalization that adapts to user input, and reward effort with tangible results rather than promises. The strongest approach enables users to create real value during onboarding, transforming the experience from passive demonstration into active participation that builds momentum toward conversion.

UNSTRUCTURED INPUT IN AI APPS INSTEAD OF WEB FORMS

AI applications can now replace traditional web forms by allowing users to submit information in any format—images, PDFs, audio, or text—while AI models handle the conversion to structured database entries. This approach utilizes systems like AgentDB's templating, allowing users to say "add this" and upload unstructured content, such as Instagram screenshots, for a concert tracker. The AI extracts required information (show, date, venue, etc.) and formats it properly for the database, eliminating the need for people to adapt their input to rigid form fields.

DOWNLOAD THE NEW IPHONE AIR AND IPHONE 17 PRO WALLPAPERS

Apple's new iPhone wallpapers are now available, with designs for the iPhone Air and iPhone 17 Pro. The Air wallpaper references the camera plateau, while the Pro wallpaper spells out “PRO” vertically. Both can dynamically color-match the device or case.

WHY ACCESSIBILITY MIGHT BE AI'S BIGGEST BREAKTHROUGH

A UK government study of Microsoft 365 Copilot found neurodiverse employees reported significantly higher satisfaction rates than neurotypical colleagues, with participants describing AI as "leveling the playing field" for workplace tasks.

DIETER RAMS IS AWARDED THE WORLD DESIGN MEDAL 2025

The World Design Organisation awarded the 2025 World Design Medal to 93-year-old Dieter Rams, recognizing his profound impact on industrial design through his 34-year tenure at Braun.

TRADER JOE'S BATTLES ITS OWN EMPLOYEES IN LOGO DISPUTE

Trader Joe's has revived its lawsuit against its employee union over allegedly confusingly similar merchandise designs, after a previous dismissal in early 2024.

See the full breakdown →

Ready to see why Bitwarden continues to lead the G2 reports for 11 consecutive quarters? Start a free trial of Bitwarden for your

business

FROM MOSTERERAT TO CLICKFIX: NEW MALWARE CAMPAIGNS HIGHLIGHT RISING AI AND PHISHING RISKS

Fortinet researchers have disclosed a sophisticated phishing campaign delivering MostereRAT, a banking malware-turned-RAT that uses the obscure Easy Programming Language (EPL), disables Windows security mechanisms, and deploys remote access tools like AnyDesk and TightVNC to maintain persistent access on compromised systems. A separate ClickFix campaign targets users searching for AnyDesk by serving fake Cloudflare verification pages that ultimately deliver MetaStealer through social engineering tactics involving Windows File Explorer and malicious LNK files disguised as PDFs. Security researchers also revealed a novel adaptation of ClickFix using CSS-based obfuscation to weaponize AI summarizers through "prompt overdose" attacks that overwhelm AI context windows to produce malicious step-by-step instructions, demonstrating how threat actors are exploiting user trust in AI-generated content.

SESSIONREAPER, UNAUTHENTICATED RCE IN MAGENTO & ADOBE COMMERCE

Adobe released an emergency patch for a critical (CVSS 9.1) vulnerability in all versions of Adobe Commerce and Magento. The vulnerability allows for customer account takeover as well as unauthenticated remote code execution in some circumstances. The attack combines a malicious session with a nested deserialization bug.

CURSOR'S AUTORUN LETS HACKERS EXECUTE ARBITRARY CODE

Cursor's AI-powered code editor ships with Workspace Trust disabled by default, allowing malicious repositories to automatically execute code through crafted ".vscode/tasks.json" files the moment a developer opens a folder, without any user prompts or warnings. Attackers can inject these malicious task files into public repositories, enabling them to compromise developer machines and access sensitive data, including API keys, cloud credentials, and SaaS sessions, simply through the act of browsing a project. Unlike VS Code, which does not auto-run tasks in default configurations, Cursor executes these tasks immediately after opening a project folder, creating a significant supply chain attack vector for the platform's one million users.

WHEN AI NUKES YOUR DATABASE: THE DARK SIDE OF VIBE CODING

A startup founder's production database was accidentally wiped by an AI coding assistant in Replit, highlighting the dangers of "vibe coding" - the practice of letting AI tools like GitHub Copilot generate code from plain English prompts without proper review. Research shows 45% of AI-generated code contains OWASP Top 10 vulnerabilities, with common issues including hardcoded secrets, weak access controls, and hallucinated dependencies that don't exist or contain security flaws. Security experts warn that "Shadow AI" development bypasses traditional code review processes, requiring organizations to treat AI-generated code like junior developer output with strict scrutiny and governance controls.

HOW AN ATTACKER'S BLUNDER GAVE US A RARE LOOK INSIDE THEIR DAY-TO-DAY OPERATIONS

Huntress gained unprecedented insight into a threat actor's operations when the attacker accidentally installed their EDR agent after finding them through a Google ad while researching Bitdefender, revealing extensive use of AI tools like Make.com for workflow automation, searches for Evilginx instances, and systematic reconnaissance targeting Nigerian banks and cryptocurrency exchanges. The actor demonstrated sophisticated OPSEC with residential proxies (LunaProxy), anti-detection browsers (Nstbrowser), and security tools (Malwarebytes) while working 12 to 14-hour days conducting research, crafting phishing messages using Google Translate, and accessing over 2,400 compromised identities. Browser history revealed their evolution from manual processes to AI-assisted workflows, including automated Telegram bot integration and the use of stolen cookies with tools like ROADtools for Microsoft Entra token exploitation.

PWN MY RIDE: EXPLORING THE CARPLAY ATTACK SURFACE

Oligo exposes Apple CarPlay's security vulnerabilities, focusing on CVE-2025-24132, a stack buffer overflow in the AirPlay protocol that enables remote code execution with root privileges. They detail how wireless CarPlay exposes vehicles to attacks, mainly because most cars rely on weak Bluetooth pairing. Attackers can exploit poor authentication to extract WiFi credentials and launch RCE attacks. Although Apple patched this in the AirPlay SDK, most car manufacturers haven't implemented these fixes, leaving many vehicles exposed.

your risk.

MFTOOL

MFTool is a red team-oriented NTFS parser that bypasses Windows file APIs by directly parsing on-disk Master File Table structures to access locked, deleted, and hidden files. The tool can retrieve sensitive files like SAM, SYSTEM, and pagefile.sys without opening OS-level file handles, effectively circumventing Windows file access controls while requiring administrative privileges. It supports regex-based searches across entire volumes and maintains an encrypted in-memory Master File Table (MFT) cache for stealthy file system operations during red team engagements.

RF-SWIFT

RF-Swift is a revolutionary toolbox that transforms any computer into a powerful RF testing laboratory without requiring a dedicated operating system. Unlike traditional approaches that force you to sacrifice your primary OS, RF-Swift brings containerized RF tools to your existing environment.

AEGIS AI (PRODUCT LAUNCH)

Aegis AI provides email security through reasoning agents, each of which is a custom-built LLM tuned to a specific threat. Once the orchestrating agent recognizes a threat or potential threat, it calls other agents in the network, and these agents then run the analysis, reason with each other, and respond to the orchestrating agent with a verdict.

GOOGLE MISLED USERS ABOUT THEIR PRIVACY AND NOW OWES THEM $425M, SAYS COURT

A court ordered Google to pay $425 million in a class action lawsuit after finding it misled 98 million users about its "Web & App Activity" privacy setting, which was supposed to stop data collection but didn't prevent Google from gathering information through its Firebase analytics system. Despite users thinking their activities were private, Google continued collecting data from apps like Uber, Venmo, and Instagram through a separate system, with internal communications revealing Google was "intentionally vague" about data collection practices to avoid alarming users. This adds to Google's history of privacy violations, including recent settlements totaling over $2 billion for misleading location tracking and incognito mode practices.

THE US GOVERNMENT HAS NO IDEA HOW MANY CYBERSECURITY PROS IT EMPLOYS

The US government lacks accurate data on the number of cybersecurity workers and contractors it employs, due to the messy, incomplete, and unreliable data across agencies. The GAO found that most departments lack standardized reporting and quality controls, and efforts to fix the situation are stalled, leaving workforce planning and effective cybersecurity policy undermined.

FORMER WHATSAPP SECURITY BOSS IN LAWSUIT LIKENS META'S CULTURE TO A “CULT”

Meta's ex-WhatsApp security chief, Attaullah Baig, has sued back, claiming the company ignored and concealed major privacy flaws, allowed over 1,500 engineers uncontrolled data access, and failed to secure and track user data. He asserts Meta retaliated against him for whistleblowing, while Meta counters that he performed poorly and misrepresented ongoing efforts to improve security.

US CHARGES ADMIN OF LOCKERGOGA, MEGACORTEX, NEFILIM RANSOMWARE

The U.S. Department of Justice has charged Ukrainian national Volodymyr Viktorovich Tymoshchuk for his role as administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations that collectively caused hundreds of millions of dollars in damages to victims worldwide.

PIXEL 10 FIGHTS AI FAKES WITH NEW ANDROID PHOTO VERIFICATION TECH

Google is integrating C2PA Content Credentials into the Pixel 10 camera and Google Photos to help users distinguish between authentic, unaltered images and those generated or edited with artificial intelligence technology.

KILLSEC RANSOMWARE IS ATTACKING HEALTHCARE INSTITUTIONS IN BRAZIL

KillSec Ransomware attacked MedicSolution, a Brazilian healthcare software provider, stealing over 34 GB of sensitive medical data, including lab results, X-rays, and patient records (including minors) from an insecure AWS S3 bucket that was exposed for several months, marking the first notable supply chain incident affecting Brazil's healthcare industry.

OPEN WEB “ALREADY IN RAPID DECLINE” GOOGLE ARGUES IN COURT DOCUMENT

Google argued in a court filing that the open web is already in rapid decline, and a breakup of its ad business would accelerate that trend. It cited AI reshaping ad tech, along with growth in formats like Connected TV and retail media, as reasons ad budgets are shifting away from open-web display advertising. The filing follows concerns about “Google Zero,” the idea that Google search could stop sending traffic to third-party sites, though Google said its AI-enabled search still directs users to a wide range of publishers. WARC data shows online display advertising is stable but growing much more slowly than search and social media advertising.