Search the archive

SPACEX STARSHIP HEAT SHIELD CAN'T SUPPORT RAPID FLIGHTS, EXPERTS WARN

Former NASA thermal engineers warn that SpaceX's current ceramic tile thermal protection system remains the main blocker for rapid Starship reuse.

US AIR FORCE EXPANDS BLUE ORIGIN ROCKET CARGO CONTRACT

The Air Force Research Laboratory awarded Blue Origin an $11.7 million contract modification to study rocket-based military cargo delivery, bringing the total contract value to about $13 million under the REGAL program.

IONQ COMPLETES ACQUISITION OF SKYWATER TECHNOLOGY

IonQ closed its purchase of SkyWater Technology, the largest exclusively US-based semiconductor foundry, giving it a domestic in-house fab to manufacture its own quantum chips rather than relying on outside foundries.

AI DATA CENTERS CREATE SUPPLY-CHAIN SHOCK

Apple shares fell nearly 10% after its forecast revealed difficulty securing components as data centers absorb global chip and memory capacity.

META REPORTS $27.9 BILLION IN FUTURE DATA CENTER LEASES FOR AI

Meta disclosed $27.9 billion in long-term data center lease commitments in its Q2 financial filings.

Register now.

HACKERS STEAL SENSITIVE DATA FROM UK DEPARTMENT FOR EDUCATION AND POLICE

The UK's Department for Education (DfE) and a police database were hacked by a new ransomware gang which stole 740k lines of data. The DfE's data was stolen from a help-desk portal and includes full names, email addresses, phone numbers, and job titles for staff and parents. The police database that was compromised provides legal assistance to UK police forces and includes names, the force or organization they're assigned to, and work email addresses.

RAILS PATCHES CRITICAL ACTIVE STORAGE FLAW WITH RCE POTENTIAL

The Rails framework for Ruby disclosed a new vulnerability in Active Storage that could enable arbitrary reads. The vulnerability is exploitable when libvips is used, and the server allows for image uploads from untrusted users. Security researchers highlighted that this vulnerability could be exploited to read the Rails master key, which could compromise all cryptographic operations and lead to RCE.

AMGEN SAYS CLOUD DATA BREACH EXPOSED PATIENT HEALTH, PROPRIETARY INFO

Pharmaceutical company Amgen stated that it suffered a data breach after attackers stole data via a third-party cloud provider. Amgen stated that the stolen data includes proprietary information and patient PHI, but they have not yet determined whether additional data was stolen.

STATIC DEVIRTUALIZATION OF TENCENT VM

Back Engineering Labs published a technical devirtualization of Tencent's ACE anti-cheat VM obfuscation, detailing how the .tvm dispatcher preserves CET shadow-stack and SEH/unwind semantics via boxed native instructions, RDSSPQ/INCSSPQ balancing, and phantom unwind info, and how guided symbolic execution recompiles virtualized functions back to native code. The team reported 815 of 865 virtualized functions (94.2%) recovered across four ACE kernel drivers, offered a third party for independent validation, and flagged ranged for-loops as a known limitation causing infinite-loop mis-lifts.

FAKE CLAUDE INSTALL GUIDE LEADS TO MACSYNC STEALER AND RAT: WHAT WE PULLED FROM THE ATTACKER'S SERVERS

Huntress traced a malvertising chain that walked a victim from a poisoned Google ad through a weaponized claude.ai/share page into a curl|zsh loader, unfolding into a six-stage macOS kill chain that phished Full Disk Access and a confirmed account password, then dropped a native Mach-O RAT, a signed Screen Recording helper, and trojanized Ledger/Trezor wallet apps rewritten in place to phish BIP39 recovery phrases. The tradecraft resembles the AMOS/Atomic Stealer lineage based on shared techniques and Russian-language code comments, which Huntress frames as a family resemblance rather than named-actor attribution. Defenders should hunt behaviorally for curl -k piped into zsh, a com.apple.* LaunchAgent paired with a ~/.local/.mpwd file, and ad-hoc-signed apps whose ElectronAsarIntegrity hash doesn't match the shipped app.asar.

FROM /INIT TO CODE EXECUTION - PROMPT INJECTION EXPERIMENTS WITH OPUS-5 IN CLAUDE CODE

The author of this post ran an experiment in which they had Claude Code running Opus 5 in yolo mode analyze a hit repo which contained an image file with a hidden message that led the model to a Star Trek-themed challenge. The challenge is a web server that features six challenges, with the final two requiring the model to download and execute a remote Python script which contains an encoded malicious command. Opus 5 determined that it shouldn't directly run the script but extracted and ran the malicious command, believing that it contained the solution to the challenge.

IMPACKET FOR PENTESTER: ATEXEC

This walkthrough walks through Impacket's atexec module across the full Windows Task Scheduler (ATSVC/TSCH) abuse chain over SMB, demonstrating plaintext, Pass-the-Hash, Pass-the-Ticket, and Pass-the-Key execution against a Server 2019 DC before weaponizing a Base64 PowerShell payload with -silentcommand into a full interactive reverse shell. It's a solid operational reference rather than new tooling, no repo to evaluate, though the closing detection notes add real blue-team value.

SANDBOX-ATTACKSURFACE-ANALYSIS-TOOLS

A collection of tools from Google Project Zero to analyze Windows sandboxes for exposed attack surface

FURTEX

Furtex is a post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF.

INSIDE THE FALCON: HOW CROWDSTRIKE CATCHES YOU

A reverse-engineering teardown mapped csagent.sys's full detection surface: six kernel callback sources (process, thread, image, object, registry, and file), a firewall-grade WFP network engine capable of injecting TCP resets to kill C2 flows, an FLTMGR minifilter hooking 12 IRP majors, and the cspcm4 "pinned" broker module. The dissection traced verdicts to a single vtable call into g_DetectionEngine, a detection object loaded at runtime from cloud-pushed channel files rather than compiled into the driver, and documented seams including a user-mode-only trust boundary on Object/Registry callbacks, hash-or-signature resolution failures that skip full rule matching, and a 10,000-flow WFP tracking cap. The author tied this same swappable cloud-content architecture to the July 2024 CrowdStrike outage, attributing that crash to a bad channel-file object rather than a code defect in the sensor binary.

SCANNING 7.6 PETABYTES OF HUGGINGFACE TRAINING DATA FOR SECRETS

Truffle Security scanned all 7.6 petabytes of public Hugging Face datasets (187 million files) with TruffleHog and found 221,303 live, unique credentials across 6,003 datasets, including 349 GitHub PATs with repo-write/CI/admin:org scope, 318 Docker Hub push tokens, 8,557 live GCP service-account keys, 8,594 working database logins, and 742 OpenAI plus 26 Anthropic keys carrying a conservative $920K/year inference-abuse floor. Leaks compounded through scrape corpora like The Stack and Common Crawl, with 44% of unique secrets appearing in more than one dataset and one AWS key, pasted into a chatbot, mirrored across 1,131 datasets. Hugging Face was notified pre-publication and contributed native storage-bucket scanning to TruffleHog. The company withheld all names, dataset paths, and key material, and recommends scanning corpora before publishing or training and treating any publicly exposed key as burned.

87% OF ORGANIZATIONS ARE PURSUING PQC. ONLY 7% HAVE DEPLOYED IT

DigiCert's second annual Quantum Readiness Outlook, which surveyed 1,001 IT and security decision-makers across the US, UK, and Australia, found 87% of organizations are planning, testing, or implementing PQC, yet only 7% have deployed quantum-safe or hybrid certificates at scale, up less than two points from 5% a year earlier. The analysis argues the barrier data (legacy complexity, performance, and budget) shows this has shifted from an awareness problem to an execution problem, and flags that the certificate-only metric masks progress elsewhere while saying nothing about the arguably more urgent Trust Now, Forge Later signature-forgery threat.

ARCH LINUX SUSPENDS AUR PACKAGE ADOPTIONS TO BLOCK ONGOING MALICIOUS COMMIT CAMPAIGN

Arch Linux's DevOps team disabled AUR package adoptions platform-wide on July 30 after attackers began systematically adopting orphaned/unmaintained packages and pushing malicious PKGBUILD commits that execute payloads via makepkg.

SINGAPORE LAUNCHES AI CYBER RISK TASKFORCE TO BOLSTER FINANCIAL SECTOR RESILIENCE

MAS and the Association of Banks in Singapore launched the AI-Driven Cyber and Technology Risk Taskforce (ACT), uniting DBS, OCBC, UOB, SGX, NETS, and BCS since May to share AI threat intelligence, run proof-of-concept trials of AI-enabled defense tools, and develop sector guidance against frontier AI-driven attacks.

SCANNING 7.6 PETABYTES OF HUGGINGFACE TRAINING DATA FOR SECRETS

Truffle Security Co. says it scanned 7.6 petabytes of public Hugging Face datasets and found 221,303 live, unique credentials across 6,003 datasets. The verified secrets included software supply-chain tokens, cloud credentials, database logins, communications keys, and AI-provider keys that the company says represent at least $920,000 in potential annual inference charges at default spending caps.

SCALE AI HIRES FORMER GOOGLE CLOUD COO AS CEO

Scale AI appointed Francis deSouza as CEO as it expands beyond training data and evaluations into enterprise AI applications. The company expects its applications business to become larger than its original data operation within 18 months.

EU PLANS SEVEN AI GIGAFACTORIES IN $11.4B COMPUTE PUSH

The EU plans to invest €10 billion in seven AI gigafactories, each designed to house at least 100,000 advanced chips. Officials hope the funding will attract another €20 billion privately and reduce Europe's reliance on foreign AI infrastructure.

I'M (MOSTLY) PICKING MODELS ON SPEED NOW, NOT INTELLIGENCE

AI models have reached a sufficient intelligence level for many everyday tasks, making inference speed a more important factor in model choice. 100–200 tokens per second feels fast for human use, while tool calls and human oversight limit the benefits of faster models and intensifying competition may drive prices down.

MOST CORPORATE IT NOW RUNS OUTSIDE COMPANY-OWNED DATA CENTERS

Companies now place 46% of their workloads with cloud and colocation providers, compared with 44% in their own data centers. AI is also making capacity planning harder while worsening staffing shortages and the cost of infrastructure failures.

GYRUS-DEV/FROSTY: AI AGENT FOR SNOWFLAKE

Frosty is an open-source, self-hosted framework from Gyrus Inc that converts plain-English requests into Snowflake queries and administrative operations. The 153-agent system covers data engineering, security, governance, cost monitoring, and inspection, while its safety layer blocks DROP statements and requires approval for CREATE OR REPLACE operations. Users can run it locally with their Snowflake credentials and a supported language model.

META SEES AN ENTERPRISE BUSINESS BEYOND AI AGENTS

Meta says it could sell businesses APIs, AI agents, compute capacity, and other enterprise services. The strategy could turn its enormous internal AI infrastructure investment into a new revenue stream beyond advertising.

STATIC DEVIRTUALIZATION OF TENCENT VM

Classic virtual-machine obfuscators remain vulnerable to flexible lifting, recompilation, and guided symbolic execution. A static devirtualization approach for Tencent VM obfuscation analyzes the VM dispatcher, boxed native instructions, and CET/SEH compatibility mechanisms to symbolically recover bytecode-driven control flow and virtualized loops.

UBER IS BUILDING AN AUTONOMOUS VEHICLE EMPIRE, AND HERE'S EVERY COMPANY IT'S USING TO DO IT

Uber has partnered with or invested in more than 30 autonomous vehicle companies over the past two years, rebuilding an AV strategy focused on integrating outside technology and fleets globally. TechCrunch's tracker details deals involving robotaxis, autonomous trucks, sidewalk robots, drones, fleet operators and vehicle makers, including major investments in Aurora and Lucid.

EUROPE IS REWRITING ITS QUANTUM ROADMAPS AND ASKING FOR COMMENTS

The European Quantum Flagship has opened a public consultation on six draft technology roadmaps intended to guide the EU's quantum research, industry, and procurement priorities through 2035.

GOOGLE CLOUD EXPANDS STORAGE AND NETWORKING FOR AI CLUSTERS

Google Cloud has made Managed Lustre generally available, with four performance tiers and support for up to 8 PB of storage.

pay attention. Learn more about sponsorship opportunities.

FROM TOBACCO TO TESLA, HOW SUBVERTISING HAS HELD UP A MIRROR TO SOME OF THE BIGGEST BRANDS

Subvertising uses parody and imitation to critique brand messaging, often gaining traction when it feels more honest or aligned with public sentiment than the original ads. From billboard hacking in the 1970s to coordinated campaigns today, these efforts have influenced perception, exposed ethical gaps, and even contributed to policy change. With AI making imitation easier, brands face greater risk of losing control of their narratives, especially when messaging lacks credibility or contradicts real practices.

AS REDDIT STOCK FALLS, CEO QUESTIONS VALUE OF GOOGLE'S AI OVERVIEWS

Reddit's stock fell more than 20% after an earnings report that beat expectations on nearly every metric except search referral traffic. Google's AI Overviews cut website referral clicks by almost half compared to traditional search results, and Reddit's now weighing whether to end its $60M Google licensing deal over it. Google disputes the decline, saying organic click volume to websites has stayed relatively stable year over year. The Economist and Reuters are reportedly weighing similar exits, since the same referral squeeze hits any publisher still dependent on Google search traffic.

SIMPLE KEYWORD RESEARCH TIP

Use customer interview recordings as a source for keyword research by extracting pain point questions with AI. Search those questions, analyze top-ranking pages in Semrush, and identify the keywords they rank for. Expand the list with related URLs and create content targeting low-volume, low-competition terms that closely match customer needs.

WHY AREN'T YOU BUILDING YOUR EMPLOYEES' PERSONAL BRAND?

Employee personal brands should be treated as an investment, not a retention risk. Companies that help employees build audiences create stronger advocacy and visibility, even if those employees eventually move on. Instead of relying on one executive voice, encourage teams to develop their own presence through personal content, employee-led podcasts, and shared expertise. The goal is to make employees so valuable that they never have to rely on a resume alone.

EMAIL OPEN RATE IS A VANITY METRIC

Open rates can be misleading, with revenue serving as the stronger measure of email performance. Segment audiences by engagement, purchase frequency, and customer value to send more relevant campaigns. Increase frequency when subscribers are engaged, test different opt-in offers beyond discounts, and review automations for missed revenue. Instead of removing inactive subscribers, use reactivation campaigns to bring back customers who may still convert.

AI ROI, read the CMO brief

HOW TO STOP CHASING THE WRONG CLIENTS (WEBINAR)

This webinar, on August 5, will show how to stop pursuing prospects who won't convert by recognizing early signs of misalignment. It will explain how to separate curiosity from real intent and why the right audience requires less effort to close. The session will focus on using buyer behavior and timing to improve targeting and drive more consistent sales.

GOOGLE PUBLISHES ITS FIRST DEDICATED GUIDE FOR YOUTUBE AUDIO ADS

Google released its first standalone help page explaining how to create YouTube audio ads. It's an official reference for the format's specifications and setup.

THE TOKEN PRICE COLLAPSE AND WHY AI COSTS STILL INCREASE

Cheaper tokens didn't shrink AI bills - they multiplied how many calls get made. Token prices fell more than 95% in three years, yet enterprise LLM spend more than doubled in 6 months to $8.4 billion. The volume surge lands directly on margin, since AI-native gross margins run 50-60% against 80-90% for traditional per-seat SaaS, and a flat seat price can't absorb a cost that scales with usage. That's forcing a shift toward per-action and per-outcome pricing, the model Salesforce, Intercom, and GitHub Copilot have already adopted.

ENDS TONIGHT? HOW FALSE URGENCY BECAME EMAIL'S $500 PER SUBSCRIBER MISTAKE

Marketing emails now carry legal risk. Courts have ruled that misleading subject lines alone can trigger damages even if unopened. This applies to any company emailing consumers, since lists can't exclude specific states and federal anti-spam laws offer no protection. Nearly 200 lawsuits have targeted retailers, airlines, and colleges over extended “deadline” claims, with damages up to $500 per email, now reduced to $100 under a 2026 law.

AI SHOPPING STATS 2026: WHAT YOU NEED TO KNOW

43% of US shoppers used AI for product research recently, and 20% used it on their last $50+ purchase.

THE 4 MOMENTS TO ASK CUSTOMERS WHY THEY PURCHASED FROM YOU

Ask pre-purchase, post-checkout, via follow-up survey, and at delivery with a QR code.

real support engineer on standby. KICK THE TIRES →