Search the archive

STACKED PULL REQUESTS ARE NOW IN PUBLIC PREVIEW

GitHub's stacked pull requests split large changes into ordered, narrowly scoped PRs that can be reviewed in parallel while preserving existing checks and branch protections.

BIG-WORLD INTUITIONS

It's best to follow universally sound principles and heuristics as they're robust to uncertainty. Behaving in a way that's usually for the best avoids issues with misreading the situation. Most of the time, for most people, following generally good heuristics is good. Play fair, mind your own business, cultivate your own garden, and do your best, and it'll mostly work out for the best in the long run.

TUNE-UP

Two-week sprints once felt radical. Bring that cadence to an AI-native team now and you might get smoked. 37signals still runs six-week product cycles, but it just cut the two-week cool-down between them to a one-week "tune-up." The team says a substantial feature that may have taken four weeks, with a real risk of six, can now ship in one.

DEAR SAASTR: HOW DO YOU STEAL CUSTOMERS FROM THE LEADER IN THE SPACE?

Show up in places where your competitors are. Most customers will buy the top brand, but not all of them, and being known will help you if your competitor ever makes a mistake. Help customers switch vendors for no additional cost. Making the process effortless will relieve any concerns about the cost of switching.

SAAS BEST PRACTICES WE LEARNED FROM SAAS IPO'S

Successful SaaS IPOs emphasize a land-and-expand model, creative pricing tied to value, and the importance of annual or multi-year contracts. Companies like GitLab leverage open-source and freemium strategies to build user bases before sales involvement. For sustained growth, SaaS firms should eye enterprise customers, maintain over 110% net dollar retention, and align go-to-market strategies with buyer behavior.

DON'T HIT THE NOS TOO SOON: A FOUNDER'S GUIDE TO PR

Lester Chen advises founders to view PR not just as a distribution channel, but as a test to gauge the external validation of their startup's story. Engaging early with professional PR services can prevent common mistakes, allowing founders to focus on tailored messaging for their specific audiences. The direct approach, favored by many now, involves founders engaging directly with their audience through personal channels, though it requires comfort with public engagement.

HOW TO GET YOUR LAUNCH TRENDING ON X (FULL GUIDE)

Successful X launches combine market-specific research, a memorable claim and demo, coordinated creator waves, and rapid comment-driven engagement. Founders then convert attention by replying, DMing sharers, delivering lead magnets quickly, and sustaining one launch narrative for 48 hours.

STACKED PULL REQUESTS ARE NOW IN PUBLIC PREVIEW

GitHub Stacked Pull Requests break large changes into small, reviewable pull requests so developers can independently review and check each pull request, then merge everything together in one click. It helps developers introduce smaller individual changes while shipping larger features. Stacked pull requests help teams keep large changes moving, maintain quality across every layer, and merge one, some, or all. The feature is built into GitHub, so existing reviews, checks, and merge requirements will work.

GEMINI LIVE API OVERVIEW

The Gemini Live API enables low-latency, real-time voice and vision interactions with Gemini. It processes continuous streams of audio, images, and text to deliver immediate, human-like responses. The API creates a natural conversational experience for users. It can be used to build real-time agents for a variety of industries.

DOMO'S UNUSUAL $400M ACQUISITION

Usually, an acquisition means selling the company. Domo is selling almost everything that makes it Domo and keeping the public company alive. After it broke a debt covenant, its lender gave it until July 31 to sign a deal. Progress Software is paying $400 million for the software, customers, and IP. What remains will have about $246 million in cash and $900 million in tax losses it can use against future profits. Progress gets the business. Domo's management gets another shot at buying something else.

HOW MERCOR BUILT A $20B MARKETPLACE WITH $71 AND A GOOGLE FORM

Mercor says it crossed a $2 billion annualized revenue run rate after doubling in four months, making it one of the fastest-growing AI companies. It's always good to see what a company like that actually looked like in the beginning. In this case, it was a software agency finding engineers through IIT coding clubs, Facebook ads, and hackathons with a $71 prize pool. When clients asked to hire those engineers, the founders ran the marketplace through WhatsApp, Google Sheets, and PandaDoc. GPT-4 scoring and the AI interviewer came later, once that manual process started to break.

MISCELLANEOUS THOUGHTS ABOUT BUILDING STUFF WITH AI IN JULY 2026

This post contains a bunch of tips and processes for working with large language models learned from working with AI over the past couple of years.

BUILDING AN ALWAYS-ON BACKGROUND AGENT TO PROACTIVELY SUPPORT CUSTOMERS

Customer Watch is an always-on agent that monitors every Parallel account for usage spikes, errors, payment failures, and customer news, then posts into a Slack thread with the right account manager looped in.

WHAT A REDDIT BUYING QUESTION ACTUALLY LOOKS LIKE: I READ ALL 148 HIGHEST-INTENT THREADS

A Reddit complaint about a tool someone already pays for can be more useful than a "recommend me a tool" post.

THE FOUNDER'S GUIDE TO MERGERS AND ACQUISITIONS

If you're going through an acquisition process, one thing to figure out quickly is what the acquirer actually wants.

COSMOSESCAPE: TAKING OVER EVERY DATABASE IN AZURE COSMOS DB

Wiz Research bypassed Cosmos DB's Gremlin sandbox by abusing .NET reflection to achieve arbitrary code execution on the DB Gateway, then extracted a platform-wide "Cosmos Master Key" capable of retrieving any account's primary key and enumerating every database on the service by tenant or subscription ID, including Microsoft's own internal Cosmos DB-backed services like Entra ID, Teams, and Copilot. The flaw affected private and network-isolated accounts as well, since the DB Gateway itself enforced isolation and was the component compromised. Microsoft deployed a hotfix within 48 hours of disclosure, eliminated the master key entirely, and completed a hardened architecture rollout by July. There was no evidence of exploitation beyond Wiz's own testing.

KINDARAILS2SHELL: CVE-2026-66066, CRITICAL ARBITRARY FILE READ AND POSSIBLE REMOTE CODE EXECUTION IN RUBY ON RAILS

CVE-2026-66066 (CVSSv4 9.5) lets an unauthenticated attacker abuse unfuzzed libvips operations during Active Storage image processing to read files accessible to the Rails process, potentially exposing secrets that enable RCE. Only the default Vips variant processor is affected, not Magick. Fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 alongside libvips 8.13+ and ruby-vips 2.2.1+, with no in-the-wild exploitation reported as of July 30. Rapid7 urges rotating secret_key_base and other exposed credentials, patching outside normal cycles, and applying Vips.block_untrusted(true) as an interim workaround where upgrading isn't immediately possible.

ESCAPING THE APPLE SANDBOX BY SPAWNING AN EXECUTABLE

CVE-2026-20628 let a sandboxed macOS process spawn a child with the posix_spawnattr_setmacpolicyinfo_np API specifying a more permissive built-in profile like no-network, which grants home directory access, then chain that into a shell config modification and Terminal launch to fully escape the sandbox. Researcher Noah Gregory reported the bug, which Apple patched in version 26.3 by blanket-denying built-in profile assignment for already-sandboxed processes unless they carry the com.apple.private.security.sandbox-spawnattrs entitlement. Defenders should ensure affected Apple devices are updated to 26.3 or later, as no more granular policy comparison was implemented.

CONTROL RELIABILITY ENGINEERING (CRE): APPLYING SRE PRINCIPLES TO CYBERSECURITY CONTROLS

Most breaches stem not from novel attacker capability but from security controls that were believed operational yet were actually broken, misconfigured, or never fully implemented, proposing Control Reliability Engineering (CRE) as a direct port of Google's Site Reliability Engineering discipline onto security controls. CRE treats a "Control Incident" (a failed defense, regardless of whether it led to a breach) with the same severity as an actual security incident, applying SLIs/SLOs, error budgets, controls-as-code, continuous control monitoring, and synthetic event injection to catch controls that silently "read zero" while broken. Security teams should build a control ontology/catalog, adopt Control Readiness Reviews before production onboarding, and formalize blameless postmortems for control failures to shift from reactive ticket-based response to engineered, metric-driven control health.

THE ONE CHOKEPOINT TO RULE THEM ALL: WHY I DELETED 50 CLICKFIX DETECTION RULES AND REPLACED THEM WITH ONE

ClickFix attacks are a growing class of attacks that trick a user into executing a malicious command by prompting them to fix or otherwise diagnose a bogus issue. At the behavioral level, a ClickFix attack boils down to a browser process losing focus, followed by a native shell gaining focus, followed by a command containing a network call being executed within 60 seconds. The post contains this behavioral detection in several languages and a demonstration of it working against several variants.

ZERO RISK ISN'T THE JOB: A CISO'S GUIDE TO AGENTIC AI

This post outlines how Anthropic assesses risk for internal agentic workloads. To understand the risk associated with an agent, Anthropic asks what untrusted content an agent will ingest, what actions the agent can take, what the blast radius is in the case of misalignment, and what observability is available. Anthropic also defines an identity access model spectrum where agents may run as a self-contained, single-purpose, least-privilege identity that does one thing for the business with no human identity on one end and human credential agents where employees use an agent such as a chatbot or Claude Cowork directly on the other end.

CISA-KEV-THREAT-INTEL-ORCHESTRATOR

An n8n workflow that pulls newly weaponized CVEs from the CISA KEV catalog every Monday and uses Google Gemini to auto-generate Sigma detection rules with Sysmon EventIDs and MITRE ATT&CK mappings, logging each CVE to Google Sheets for compliance and emailing analysts a weekly briefing.

DEDUPINSPECTOR

DedupInspector is a lightweight, portable, offline forensic utility for recovering files from Windows Data Deduplication volumes.

CODENEEDLE

CodeNeedle is a VS Code extension that silently exposes JavaScript code execution over a local HTTP endpoint. Once loaded into a target's VS Code instance, the extension listens on localhost for incoming JSON-RPC requests, evaluates arbitrary JavaScript code, and returns results to the caller.

LINUX XMRIG BOTNET ABUSES PAM FOR FILELESS MONERO MINING AND PERSISTENT ACCESS

A V25 (Generation 26) cryptomining campaign gained initial access through a trusted third-party relationship, then weaponized Linux PAM's pam_rootok policy to move password-lessly from root into ordinary user accounts, fragmenting malicious activity across shadowed identities in a "hydra-like" persistence model. The customized XMRig 6.25.0 build self-unlinked its own binary after execution, running fileless from memory while suppressing authentication logs and masquerading its process listings and network traffic. The operation reflects a broader trend in Linux cryptomining tradecraft, where supply chain compromise, identity-layer abuse, and anti-forensic design are converging to outpace file-based and DNS-centric detection models.

SOME THOUGHTS ABOUT ANTHROPIC'S NEW CRYPTANALYSIS RESULTS

Anthropic recently announced that its unreleased Mythos model discovered two novel attacks against the post-quantum cryptography hashing candidate HAWK and a reduced-round AES variant. The HAWK attack was in fact novel, but it only effectively reduced the strength of the cipher by halving the bits, whereas the AES attack was a slight speed-up of a theoretical attack from 2013. The model was able to develop the attacks with a naive prompt, and from that perspective, the results are still meaningful.

CISA SETS A NEW SBOM BASELINE

The CISA has released the 2026 Minimum Elements of a Software Bill of Materials (SBOM) to replace the NTIA's 2021 version. The new version introduces new elements including component hash algorithms, component licenses, the name of the tool that generated the SBOM, and the generation context. CISA highlights cloud software, AI, SBOM validation, and linking an SBOM to security alerts as future areas of development.

NORTH KOREA'S LAZARUS GROUP SHARING TOOLS WITH RANSOMWARE HACKERS, SOUTH KOREAN AGENCIES WARN

AhnLab's "Operation Double Barrel" report found Lazarus and the Gunra ransomware group exploiting identical vulnerabilities in mandatory Korean financial security software, sharing malware filenames, C2 servers, and SSH key fingerprints while running parallel espionage (72+ organizations breached) and extortion campaigns across South Korea from 2025 into 2026.

CHROME NEEDS TWICE-A-WEEK PATCHING THANKS TO AI BUG HUNTING

Google's Chrome security team fixed 1,072 bugs across June's two major releases, more than the prior 23 releases combined, driven largely by AI-assisted vulnerability discovery.

NOT JUST OPENAI: NOW ANTHROPIC SAYS ITS INTERNAL MODELS GOT ONLINE AND CYBERATTACKED 3 OTHER ORGANIZATIONS

Anthropic discovered that Claude models unintentionally reached the public internet during supposedly isolated cybersecurity evaluations and compromised systems belonging to three real organizations using weak passwords and unauthenticated endpoints. The incidents involved Opus 4.7, Mythos 5, and an internal research model, with the earliest dating back to April, and were uncovered only after Anthropic reviewed more than 141,000 test sessions following OpenAI's similar incident. Anthropic suspended its cyber evaluations and notified the affected organizations, two of which had not detected the activity.

THE MAJORITY OF CORPORATE IT IS NOW OFF PREMISES FOR THE FIRST TIME

Third-party facilities now host 46% of enterprise workloads, compared with 44% in company-owned datacenters, marking the first time off-premises infrastructure has taken the lead, according to Uptime Institute's survey of more than 800 operators. Typical rack density also climbed above 11 kW as organizations replace older servers with more power-hungry hardware.

MICROSOFT CONFIRMS AN AI WORM IS PROPAGATING THROUGH COPILOT AND OTHER MS APPS

Researchers demonstrated a document-borne attack that hides instructions inside files processed by Copilot, alters generated content, and copies itself into newly created documents. Microsoft has deployed mitigations, but researchers say the underlying problem remains because current models cannot reliably distinguish untrusted data from executable instructions.

DNS IS INFRASTRUCTURE. IT'S TIME TO MANAGE IT THAT WAY

DNS is often managed through manual dashboards and scattered accounts even though a single incorrect change can disrupt websites, email, certificates, and other critical services. Bring domain and DNS management into Infrastructure as Code, APIs, and CLI workflows so changes are repeatable, reviewable, automated, and easier to audit or roll back.

DATA CENTER BACKLASH COULD SLOW CIOS' AI PLANS

Opposition to new data centers is becoming a material infrastructure and budgeting risk, with protests organized across 42 states, construction moratoriums active in 10 states, and new large-load electricity tariffs emerging across the country. CIOs may need to secure capacity earlier, reconsider cloud and colocation cost assumptions, diversify regions and providers, and treat compute and power as strategic supply-chain dependencies.

OKTA BUYS AI SECURITY STARTUP PERMISO - SOURCE SAYS FOR ABOUT $200M

Okta agreed to acquire Permiso Security in a deal reportedly worth just under $200 million, adding technology that detects suspicious behavior involving employees, service accounts, applications, and AI agents after they have authenticated. The acquisition pushes Okta deeper into identity threat detection and response and the security operations center, with capabilities for identifying excessive privileges, compromised identities, and anomalous agent activity across cloud and SaaS environments.

INFORCER RAISES $50M TO HELP PREPARE SMALLER BUSINESSES FOR A NEW WORLD OF AI AND SECURITY RISKS

Inforcer raised a $50 million Series C to expand its platform for MSPs managing Microsoft 365 environments across multiple small and midsize businesses. The company says revenue is growing 300% year over year as it adds capabilities for detecting unauthorized AI use and responding to security threats across customer environments.

OUTDOOR WI-FI FINALLY MEANS BUSINESS

Cisco's outdoor Wireless 9177 Series combines tri-band Wi-Fi 7 with automated frequency coordination for outdoor 6 GHz access and Ultra-Reliable Wireless Backhaul for multigigabit connectivity and sub-10-millisecond handoffs. The access points offer directional, omnidirectional, and external-antenna models, copper or fiber uplinks, and cloud or on-premises management for campuses, ports, industrial facilities, stadiums, and transit environments.

STEP-BY-STEP FABRIC DEPLOYMENT WITH CISCO NEXUS HYPERFABRIC

Nexus Hyperfabric lets IT teams design cloud-managed VXLAN EVPN networks using validated templates, automatically generate hardware bills of materials, and perform guided zero-touch deployments. The platform abstracts much of the BGP, VXLAN, and cabling complexity normally associated with datacenter fabric deployments.

RUSSIAN SPIES TAKE THEIR HALF-CLICK EMAIL ATTACK FROM ZIMBRA TO OUTLOOK

A Russian espionage group is exploiting an on-premises Outlook Web Access flaw that can install a mailbox-based browser implant when a victim opens a malicious email.

QUALCOMM SHOWS APPLE'S MODEM TRANSITION IS ALMOST COMPLETE

Qualcomm's latest comments suggest Apple is moving more quickly toward replacing third-party modems with its own chips, potentially improving battery efficiency while reshaping the mobile-device supply chain.

→ SEE HOW SOG BUILDS REDDIT STRATEGY

REPORT: AI SEARCHES WHAT IT REMEMBERS

AI search visibility depends heavily on whether a model already remembers a brand before it searches the web. A new report found that remembered brands were searched 3.2 times more often than brands outside the model's memory, with search rates of 55.7% versus 17.4% across nearly 4,000 AI responses. Category authority built through press coverage, analyst mentions, partnerships, and consistent brand association appears to increase the odds that AI models will search for and recommend a brand. Strong live content still helps newer brands appear in AI searches, but building long-term brand recognition gives a more reliable path to visibility across future AI answers.

WHEN MARKETING RUNS ITSELF

Self-improving marketing is already live, with AI systems running continuous loops that execute and refine their own work. In one case, an SEO loop ran every 2 hours for 9 weeks, while another saw organic sessions jump 85% alongside more efficient paid performance. Each cycle builds on the last, compounding gains over time. As execution becomes automated, the role of marketing shifts toward setting direction and judging outcomes, while the system handles ongoing optimization.

BRIBES WORK: THE BEST WAY TO GROW YOUR EMAIL LIST THAT'S STILL UNDERUTILIZED

Growing an email list starts with creating discovery content on a consistent schedule and using lead magnets to capture subscribers. Instead of lengthy ebooks or courses, businesses should create quick, actionable resources like templates, swipe files, and checklists that solve a specific problem. These can be repurposed from existing newsletters, social posts, videos, or client materials. Testing new lead magnets monthly and promoting them through social channels, websites, and email flows helps find what drives conversions.

CASE STUDY: HOW A WEBSITE REDESIGN DELIVERED THE BEST YEAR EVER FOR CHURNET VALLEY RAILWAY

A research-led website redesign can grow conversions without risking revenue when every change is validated through testing before launch. Churnet Valley Railway used user research to find specific friction points, then rolled out A/B tested updates one page at a time. The homepage redesign increased conversions by 5%, and reusing proven design patterns helped lift Breakfast Train bookings by 10%, Midweek Lunch Train bookings by 48%, and dining page conversions by 13%. The program also showed that practical information, customer FAQs, and richer visuals such as video can increase bookings, which helped the railway sell out its Christmas event after a 7% booking increase.

HOW TINDER IS GETTING PEOPLE OFF THE APP AND INTO THE WILD

Tinder is trying to get its users out of the swipe screen and into cooking classes and mahjong nights instead. The feature grew out of research into Gen Z's post-pandemic social atrophy, letting users see who's attending an event beforehand and swipe on them afterward rather than in the moment to reduce the pressure of in-person rejection. Nearly 70% of eligible users engaged during a 60-plus event LA pilot, and it's now expanding to 26 cities across the US and Europe by September, one of Tinder's largest financial and engineering bets in a decade.

SAVE A SPOT →