Search the archive

PERPLEXITY FOR GOVERNMENT

Perplexity introduced a secure, zero-data-usage AI platform for U.S. government agencies, alongside a $0.25-per-user Enterprise Pro offering tailored to public sector needs.

ANTHROPIC BACKS CALIFORNIA AI SAFETY LAW

Anthropic endorses California's SB 53, a bill mandating transparency in safety practices for frontier AI systems.

COGNITION RAISES OVER $400M AT $10.2B VALUATION

Cognition raised over $400M at a $10.2B valuation, in a funding round led by Founders Fund with participation from Bain Capital Ventures and others.

FIDELITY LAUNCHES TOKENIZED TREASURY FUND ON ETHEREUM

Fidelity has quietly launched the Fidelity Digital Interest Token (FDIT) on Ethereum, a tokenized version of its Treasury money market fund that has already accumulated over $200 million in assets since beginning operations in August. The move puts Fidelity in direct competition with BlackRock's BUIDL fund, which dominates the tokenized Treasury market with over $2 billion in assets under management, as part of a broader $7 billion tokenized Treasury ecosystem that includes offerings from Franklin Templeton and WisdomTree. Despite currently having only two holders, FDIT marks another major traditional finance player adopting blockchain infrastructure to improve market efficiency, reduce settlement times, and cut costs. McKinsey analysts project that tokenized securities could reach $2 trillion in market value by the end of the decade.

COULD A DOGECOIN ETF BE LAUNCHED THIS WEEK?

The Rex-Osprey DOGE ETF ($DOJE) is expected to launch this week, becoming the first U.S. exchange-traded fund to provide direct exposure to Dogecoin's price movements. The ETF is backed by REX Shares and Osprey Funds, the same firms behind the Solana staking ETF that launched earlier this year, and represents the latest expansion of crypto ETF offerings following the approval of spot Bitcoin and Ethereum products in 2024. DOGE has rallied 7% in the past 24 hours and 15% over the week in anticipation of the launch, outperforming major cryptocurrencies as market participants expect increased volatility and potential speculative inflows. The launch comes amid a broader race among issuers to create ETF products tied to alternative cryptocurrencies, with Canary Capital also recently filing for a TRUMP coin ETF in late August.

NATIVE USDC AND CCTP V2 COMING TO HYPERLIQUID

Circle announced that native USDC and its upgraded Cross-Chain Transfer Protocol (CCTP V2) will soon be live on Hyperliquid's HyperEVM. This integration enables direct USDC deposits into HyperCore, institutional-grade on/offramps via Circle Mint, and seamless use across HyperEVM apps. With CCTP V2, developers can build efficient crosschain apps for swaps, treasury rebalancing, and onboarding, positioning USDC as a key settlement asset for Hyperliquid's trading and DeFi ecosystem.

ETHEREALIZE'S NEXT CHAPTER

Etherealize is building institutional-grade infrastructure on Ethereum, including zero-knowledge privacy tools, settlement engines, and tokenized fixed income applications. The company was co-founded by former Ethereum Foundation research lead Danny Ryan and Wall Street veteran Vivek Raman, with a team combining Ethereum core developers and executives from Goldman Sachs, JPMorgan, and other major financial institutions. Since launching in January, Etherealize has engaged with hundreds of banks and asset managers, collaborated on bringing new tokenized assets onchain, and testified before Congress on digital asset regulation. There is growing institutional momentum around Ethereum, which now processes 95% of stablecoin volume and 82% of tokenized real-world assets, positioning it as the dominant platform for institutional blockchain adoption.

THE BIDDING WAR FOR USDH ON HYPERLIQUID

Hyperliquid's upcoming native stablecoin, USDH, has drawn competing proposals from Paxos, Frax, and Agora, each offering different approaches to compliance, yield sharing, and ecosystem integration. Paxos leans on regulatory clarity and institutional bridges like PayPal, and Frax emphasizes zero-fee DeFi-native efficiency with frxUSD backing, while Agora pledges 100% net revenue sharing through a coalition model with partners like Rain and LayerZero. The outcome, chosen by validator vote, will shape how Hyperliquid transitions away from its current heavy reliance on USDC.

HYPERLIQUID: THE BLOCKCHAIN TO HOUSE ALL FINANCE

Hyperliquid isn't just the largest decentralized perp exchange, it's building the foundation to house all of finance. Legacy banking runs on outdated 40+ year-old tech stacks like COBOL, leaving institutions fragmented and opaque. Hyperliquid instead offers a unified chain with deep liquidity, builder incentives, and HIP-3 permissionless markets. With 279+ projects already building via Builder Codes, a forthcoming native stablecoin (USDH), on/off-ramps, and gasless transfers, Hyperliquid could become the global settlement layer for everything from spot trading to payments, positioning $HYPE as core infrastructure for the next trillion-dollar opportunity.

USDH STABLECOIN CUSTODIAN SCRUTINY

Bridge's reliance on a small regional bank (with a <$2B balance sheet) is a scaling risk for Hyperliquid's planned USDH stablecoin. With $5B already in USDC deposits on Hyperliquid, custodians need GSIB-level infrastructure (e.g., State Street with $49T assets) to support growth. Smaller banks face regulatory limits when deposits expand too quickly, which can halt scaling and damage customer confidence.

TEMPO'S ARGUMENT FOR L1 FINALITY

Tempo should be a standalone L1, not an Ethereum L2, because real-world payments require sub-second finality that Ethereum (15m) and Bitcoin (60m) can't provide. Since most rollups inherit Ethereum's long finality window, they aren't viable for physical goods or services that can't be reversed. By contrast, self-settled rollups (like those built with Sovereign SDK on Celestia) already hit ~6s finality and are expected to drop to ~300ms, making them better suited for payment rails.

REVENUE TO TOKEN HOLDERS INCREASING

Over the past year, more protocols have been sharing larger portions of revenue with their token holders, with the biggest distributors being Pump, Hyperliquid, and Aerodrome.

ETHEREUM VALIDATOR FLOWS FLIP BACK TO GROWTH

The ETH validator entry queue has overtaken the unstaking queue, signaling renewed demand for staking.

STABLECOINS: FROM REGULATORY ARBITRAGE TO MARKET REALITY

Stablecoins do not only thrive because of regulatory arbitrage.

PREDICTION MARKET AGGREGATOR

This website shows markets across Polymarket, Kalshi, and Limitless.

'HELP ME CREATE' IN GOOGLE VIDS NOW INCLUDES SUPPORT FOR GOOGLE SLIDES

Google Vids' "Help me create" feature now supports Google Slides as reference material for AI-powered video creation. Users can incorporate slides, images, and text from presentations into video drafts by referencing them with the "@" symbol in prompts. The gradual rollout began on September 2 for most Google Workspace plans and Gemini subscribers.

LIVE PHOTOS ARE COMING TO WHATSAPP

WhatsApp's latest beta updates now allow motion photos on Android and full Live Photo support on iOS, letting users share images with both movement and audio intact. Cross-platform compatibility ensures Android users see them as motion photos and iOS users as Live Photos, while users retain the option to send them as static images. The feature is currently rolling out gradually to selected testers.

LEAKED IMAGES PROVIDE FIRST REAL LOOK AT APPLE'S UPCOMING CROSSBODY STRAP ACCESSORY

Leaks show Apple's upcoming iPhone 17 will include a new crossbody strap accessory in vibrant orange, confirmed by images from leaker Sonny Dickson, matching earlier “TechWoven” case leaks with lanyard holes for attachment. The final product and full color options will likely be revealed at Apple's iPhone 17 event today.

PRODUCT TRIOS ARE COLLAPSING. HERE'S HOW DESIGNERS CAN SMOOTH THEM OVER

Product trios are increasingly dysfunctional, with designers often supporting multiple PMs or engineers due to resource constraints and unclear design value. Designers can repair these imbalanced teams by becoming strategic translators who bridge gaps between metrics-focused PMs and feasibility-focused engineers, framing design requests through business impact using techniques like "so I can" statements. They should also position themselves as risk reducers by validating user desirability before costly development begins, and understand teammates' individual motivators to craft more compelling arguments for design's strategic value.

THE CASCADE EFFECT IN CONTEXT-BASED DESIGN SYSTEMS

Context-based design systems cascade structured meaning and intent through each workflow layer, not just visual values like traditional systems. When design decisions carry context about purpose and reasoning, each downstream phase becomes more intelligent and capable of making correct decisions. This cascading approach enables AI-powered tools and non-developers to participate meaningfully in creation while maintaining system integrity through inherited context.

WHAT DIGITAL UX CAN LEARN FROM THE PHYSICAL MEDIA REVIVAL

UX designers can learn from physical media to make digital streaming more human and satisfying by reducing choice, adding constraints, limiting personalization, increasing customization and curation, and even offering retro emulations. While digital convenience dominates, reflecting on the tactile, deliberate, and curated experience of physical formats can improve engagement and user satisfaction without fully abandoning streaming's speed and flexibility.

DISCOVER PREMIUM UI SECTION TEMPLATES

This library features modular UI sections for Webflow, Figma, and Framer crafted by designers who care about detail, hierarchy, and soul.

YOUR WORDS TO MOBILE APPS

CatDoes turns your ideas into fully functional apps without writing a single line of code. Just tell it what you need, and watch AI bring it to life.

90'S CURSOR EFFECTS

Go back to the wonderful days when knowing how to get your little mouse arrow to dance and sway was most of your worries. Each of the cursor effects below is built for your modern browser and is super easy to add to your site.

FIGMA: HOW TO OPT OUT OF AI FEATURES?

Figma automatically enrolled all users except enterprise customers into AI training using their design files without notification or consent, sparking widespread backlash from the design community. The company employs dark patterns by burying the opt-out setting deep within team settings rather than easily accessible account preferences. This incident reflects a broader industry trend where companies prioritize data collection over user consent, following similar controversies like Adobe's recent AI training policies.

CREATIVES SHARE TRICKS FOR TAMING IMPOSTER SYNDROME THAT ACTUALLY WORK

Imposter syndrome is common among creatives at all levels, but it can be managed through a mix of practical strategies, community support, and mindset shifts. Techniques include documenting achievements, naming your inner critic, starting projects with small actions, focusing on facts or checklists, practicing self-compassion, and remembering that everyone experiences doubt. Acknowledging these feelings and sharing strategies helps reduce their power.

HOW DO YOU REBRAND ONE OF EUROPE'S LARGEST FOOTBALL CLUBS? SMÖRGÅSBORD STUDIO SHARES ITS WISDOM

Smörgåsbord Studio rebranded AFC Ajax for its 125th anniversary, creating a comprehensive visual system that honors the club's heritage while modernizing its identity. The project included a bespoke 15-weight typeface, updated graphics, color palettes, icons, digital templates, and jersey designs, all designed to be flexible across contexts and reflect Ajax's “Total Football” philosophy through a unified, adaptive “Total Design” system.

NIKE RISKS EVERYTHING WITH BOLD 'WHY DO IT?' CAMPAIGN

Nike has launched a new "Why do it?" campaign that questions its iconic "Just do it" tagline while keeping the original slogan intact.

DESIGN SYSTEM AMBASSADORS–THE GOLDILOCKS OF COLLABORATION

Design system teams struggle with balancing connection and scalability, often cycling through over-engagement, on-demand availability, and complete isolation.

APPLE REMINDERS ON MACOS TAHOE INCLUDES THIS INTERESTING PIECE OF VINTAGE UI DESIGN

Despite recent macOS redesigns like Big Sur (2020) and Tahoe (2025), Apple Reminders still features an outdated photo picker interface that looks like it dates back to OS X Leopard.

Get the guide 📥

FINANCIAL SERVICES FIRM WEALTHSIMPLE DISCLOSES DATA BREACH

Canadian financial services firm Wealthsimple disclosed a data breach detected on August 30 that exposed the personal information of fewer than 30,000 customers (less than 1% of its 3 million client base) through a compromised third-party software package. The stolen data included contact details, government IDs, financial account numbers, Social Insurance Numbers, IP addresses, and dates of birth. No passwords or customer funds were compromised. Wealthsimple is providing affected customers with two years of free credit monitoring, dark-web monitoring, identity theft protection, and insurance. It confirmed the incident was unrelated to recent Salesforce breaches.

GHOSTACTION ATTACK STEALS 3,325 SECRETS FROM GITHUB PROJECTS

The GhostAction supply chain attack compromised 817 GitHub repositories by injecting malicious workflow files that appeared to be routine automation scripts but actually exfiltrated CI/CD secrets to an external server. The campaign affected 327 developers across multiple programming languages, stealing 3,325 secrets, including npm, PyPI, DockerHub tokens, and AWS credentials that could enable further attacks on software supply chains. The attackers personalized each commit and analyzed legitimate workflows to identify which secrets to target. At least 24 projects (9 npm and 15 PyPI) remain at risk from compromised tokens despite no confirmed malicious package releases yet.

OVER 6,700 PRIVATE REPOSITORIES MADE PUBLIC IN NX SUPPLY CHAIN ATTACK

Hackers used stolen secrets from Nx to expose over 6,700 private repositories in a major supply chain attack that targeted hundreds of organizations. The threat actors leveraged malicious Nx packages to steal API keys and credentials, and exploited the compromised accounts to publish sensitive data from private repositories to public GitHub repositories.

GPUGATE MALWARE: MALICIOUS GITHUB DESKTOP IMPLANTS USE HARDWARE-SPECIFIC DECRYPTION, ABUSE GOOGLE ADS TO TARGET WESTERN EUROPE

Russian-speaking threat actors deployed the "GPUGate" campaign using a sophisticated multi-stage attack combining Google Ads malvertising, GitHub commit manipulation, and hardware-specific GPU-gated decryption to target Western European IT professionals with fake GitHub Desktop installers. The attackers leveraged Google's paid search results, modified legitimate GitHub repository commits to include malicious download links, and created 128MB installers with OpenCL-based decryption that only executes on systems with real GPUs (device names >10 characters), effectively bypassing sandbox analysis. The campaign demonstrates advanced evasion tactics, including UAC bypass, Windows Defender exclusions, persistence through scheduled tasks, and modular payload delivery, with the ultimate goal of credential theft, lateral movement, and potential ransomware deployment targeting high-value IT sector victims.

REVERSE ENGINEERING OF APPLE'S IOS 0-CLICK CVE-2025-43300: 2 BYTES THAT MAKE SIZE MATTER

CVE-2025-43300 is a zero-click out-of-bounds write vulnerability in the ImageIO framework that occurs when processing DNG images with JPEG lossless compression. Exploited in the wild, the vulnerability stems from incorrect buffer allocation and loop bounds in the lossless JPEG decompression code, where the system assumes at least two components per pixel but processes images with only 1 component, causing writes beyond allocated memory. Apple's patch adds bounds checking to verify buffer size before each write operation and raises an exception when the buffer would be exceeded, fixing the mismatch between allocated buffer size (based on components per pixel) and actual write operations.

ESCAPING THE CONFINES OF PORT 445

Attackers are restricted to using port 445 when performing NTLM relay attacks on SMB in Active Directory environments. A common strategy to get around this limitation is by extracting the SAM and SYSTEM registry hives to dump NT hashes, but this often triggers alerts or is blocked by EDR. This article details a technique that uses Service Control Manager (SCM) to start the Webclient service, which offers more lateral movement options.

Download the Report

DITTOBYTES

Dittobytes compiles C-code into truly Position Independent Code (PIC) for Windows, macOS, and Linux. Supporting AMD64 and ARM64, it has a metamorphic engine that ensures each compile produces unique, functional shellcode. The resulting shellcode is very small and simple and has minimal overhead.

FIRECOMPASS (PRODUCT LAUNCH)

FireCompass is a platform that integrates attack surface management, continuous threat exposure management, network and application penetration testing, penetration testing as a service, and red teaming.

FINDMYTAKEOVER

findmytakeover is a tool that detects dangling DNS records in a multi-cloud environment. It achieves this by scanning all DNS zones and infrastructure within the configured cloud service provider, whether in a single or multiple accounts, to identify DNS records for which the underlying infrastructure no longer exists, rather than relying on a wordlist.

GERMANY CHARGES HACKER WITH ROSNEFT CYBERATTACK IN LATEST WAKE-UP CALL FOR CRITICAL INFRASTRUCTURE

German prosecutors charged a 30-year-old man with computer sabotage, data alteration, and espionage for attacking Rosneft Deutschland in March 2022, stealing and deleting 20 terabytes of data while leaving a "Glory to Ukraine" message, costing the company €12.36 million in damages. The attack, conducted in the aftermath of Russia's invasion of Ukraine, exposed sensitive internal communications and corporate documents, with the stolen data later distributed by the Anonymous hacktivist collective. The incident highlights the vulnerability of critical energy infrastructure to cyberattacks, particularly during geopolitical tensions, emphasizing the need for enhanced cybersecurity measures in essential services sectors.

SEXTORTION WITH A TWIST: SPYWARE TAKES WEBCAM PICS OF USERS WATCHING PORN

A new variant of spyware called Stealerium can automatically take webcam photos of people while they watch porn, then send these to hackers for possible blackmail. Distributed as free, open-source code, it infects users via phishing emails. Researchers say this marks a move from large-scale ransom to more personal extortion, and warn it's hard to track individual victims.

THE CRAZY, TRUE STORY BEHIND THE FIRST AI-POWERED RANSOMWARE

NYU researchers built an AI-powered ransomware as a proof-of-concept, showing how large language models can automate targeted ransomware attacks. Their project, initially intended for research purposes, was flagged by security experts as a real threat after it was uploaded to VirusTotal. The experiment highlights growing concerns that, soon, cybercriminals will be able to easily weaponize AI for sophisticated, undetectable attacks.

incident. Read the full analysis

MAX SEVERITY ARGO CD API FLAW LEAKS REPOSITORY CREDENTIALS

A maximum severity vulnerability (CVE-2025-55190, CVSS 10.0) in Argo CD allows API tokens with minimal project-level get permissions to bypass isolation mechanisms and retrieve all repository credentials, including usernames and passwords.

NPM DEBUG AND CHALK PACKAGES COMPROMISED

Attackers injected malware into npm packages like debug, chalk, supports-color, and strip-ansi, targeting crypto/web3 wallets in browsers.