Search the archive

AI DRIVES RECORD SEED FUNDING IN 2025

In 2025, seed funding surged with record-breaking rounds, particularly in AI, and US companies secured nearly half of the global seed investments.

NOBODY "WANTS" AI

Henry Ford's customers didn't want cars, they wanted to get from point A to point B - cars just fit that demand better than horses.

SILENCE MIGHT BE KILLING YOUR CULTURE

Leaders talk constantly - emails about deadlines, budget updates, workflow changes - but go months without mentioning vision or values.

VIBE CODING WON'T KILL SAAS

Vibe coding is changing how value is communicated - people will still pay for edge cases, interrogations, and the accumulated wisdom from serving real customers with real problems.

Get the free guide

FIELDTEX DATA BREACH IMPACTS 238,000

Fieldtex Products, a US medical supply and contract sewing provider, reported unauthorized access to its systems in mid-August that exposed protected health information for about 238K individuals, including names, addresses, dates of birth, insurance IDs, plan details, and gender. Akira ransomware has claimed responsibility, saying it stole over 14 GB of corporate, employee, customer, and financial data.

DATA BREACH AT CREDIT CHECK GIANT 700CREDIT AFFECTS AT LEAST 5.6 MILLION

A hacker accessed 700Credit's systems and stole personal data, including names, addresses, dates of birth, and Social Security numbers for at least 5.6 million people whose details were collected by US auto dealerships between May and October. The company is notifying victims by mail. Michigan's attorney general has urged affected individuals to use credit freezes or monitoring to reduce their risk of fraud.

HOME DEPOT EXPOSED ACCESS TO INTERNAL SYSTEMS FOR A YEAR, SAYS RESEARCHER

Security researcher Ben Zimmermann discovered an exposed GitHub access token belonging to a Home Depot employee that granted access to hundreds of private source code repositories, cloud infrastructure, and critical systems, including order fulfillment and inventory management, for approximately one year. Despite multiple attempts to privately disclose the issue via email and LinkedIn to Home Depot's CISO, Zimmermann received no response until TechCrunch contacted the company, highlighting the absence of a vulnerability disclosure or bug bounty program. Home Depot revoked the token's access following media outreach, but has not confirmed whether logging capabilities exist to determine if unauthorized parties accessed internal systems during the exposure period.

HOW WE GOT HIT BY SHAI-HULUD: A COMPLETE POST-MORTEM

Shai-Hulud 2.0 is a malicious npm supply-chain worm that abuses install-time scripts to run hidden malware on developer machines, steal credentials with tools like TruffleHog, and then exfiltrate them to attacker-controlled GitHub repositories using obfuscation techniques such as multi-layer base64 encoding. With stolen tokens, it can mass-clone private code, attempt destructive git operations, and, if npm publish credentials exist, automatically republish trojanized versions of popular packages, rapidly propagating through the JavaScript ecosystem. Recommendations to prepare against it include disabling npm scripts by default, adopting pnpm's safer defaults and minimum package age, enforcing branch protection everywhere, and moving to short-lived CI-based publishing via OIDC to eliminate long-lived secrets on developer laptops.

A LOOK AT AN ANDROID ITW DNG EXPLOIT

Google Project Zero analyzed in-the-wild DNG image exploits targeting Samsung's Quram image parsing library (CVE-2025-21042), discovered through suspicious files uploaded to VirusTotal that were distributed via WhatsApp and exploited Samsung's com.samsung.ipservice process when images were automatically scanned. The vulnerability allowed out-of-bounds writes through malformed DNG opcode parameters, which attackers leveraged to corrupt heap metadata, bypass ASLR through crafted MapTable operations that leaked library addresses, construct JOP chains, and ultimately achieve system() command execution to deploy spyware—all without control flow integrity mitigations like PAC/BTI present in the Quram library. Samsung silently patched the vulnerability in April by adding bounds checks to prevent plane index overflows. The case demonstrates how image format specifications provide powerful exploitation primitives that enable single-bug exploits to achieve interactionless remote code execution and access to all media store contents, capabilities that would likely have been prevented by MTE deployment.

CAPABILITIES ARE THE ONLY WAY TO SECURE AGENT DELEGATION

Traditional IAM systems are inadequate for securing AI agent delegation because they verify identity rather than track authority derivation across dynamic task chains, creating the Confused Deputy problem where agents possess ambient permissions without understanding their origin or intended scope. Capability-based authorization systems address this by treating authority as cryptographically-signed tokens that are explicitly passed between agents, monotonically attenuated at each delegation hop, bound to holder keys for proof of possession, and automatically expire when tasks complete. This model prevents prompt injection attacks from escalating to data exfiltration by ensuring agents can only exercise the specific, constrained authority delegated to them rather than role-based permissions, making injection attempts succeed at the language layer but fail at the authorization layer.

a Leader.

LUMIA SECURITY (PRODUCT LAUNCH)

Lumia Security provides a network-level security and governance platform that gives enterprises visibility and control over how employees and autonomous agents use AI tools. It understands AI interactions' intent and context, continuously evaluates risk, and enforces policies across thousands of AI applications.

BLACKARCH

BlackArch Linux is an Arch Linux–based penetration testing distribution for penetration testers and security researchers. The repository contains 2,880 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installations.

KALI LINUX 2025.4 RELEASED WITH 3 NEW TOOLS, DESKTOP UPDATES

Kali Linux 2025.4 introduces three new penetration testing tools (bpf-linker, evil-winrm-py, and hexstrike-ai) alongside major desktop environment upgrades, including GNOME 49 with complete transition to Wayland and removal of X11 support. The release includes expanded Kali NetHunter support for Android 15/16 devices with Wifipumpkin3 preview for rogue access point attacks, enhanced VM guest utilities support for VirtualBox, VMware, and QEMU, and distribution changes requiring BitTorrent for Live image downloads due to increased file sizes. Users can upgrade existing installations via apt commands or download fresh ISO images. The update focuses on improving both security testing capabilities and user experience across desktop environments.

NEW REACT VULNS LEAK SECRETS, INVITE DOS ATTACKS

THE US DIGITAL DOXXING OF H-1B APPLICANTS IS A MASSIVE PRIVACY MISSTEP

The US State Department mandated that H-1B visa applicants and their H-4 dependents set all social media profiles to public starting December 15, ostensibly to screen for national security threats through “online presence reviews” that assess hostility toward US institutions, effectively forcing digital exposure on over a million technology workers and their families. This policy creates severe security risks by providing foreign adversaries with free organizational intelligence on defense contractors, chip makers, and AI labs, exposing workers to spear-phishing, SIM swapping, recruitment exploitation, and extortion tactics while turning legitimate employees into attack vectors through publicly available personal data that can be scraped and weaponized for deepfake impersonations and social engineering. The mandatory public exposure normalizes government-mandated privacy erosion while ironically creating the intelligence security risks it aims to prevent, as sophisticated threat actors using fake accounts remain hidden while legitimate applicants become vulnerable targets with their professional affiliations, family connections, and personal vulnerabilities exposed to hostile nation-state surveillance operations.

KEY BARRIER TO ONLINE FRAUD CAN BE BYPASSED FOR PENNIES

Researchers from the University of Cambridge have determined that SMS numbers, which are commonly used by services to verify account activation and combat fraud, can be readily purchased, typically for less than 30 cents each. Costs varied by country, with the UK and Russia selling for 10 cents at the lower end, and Australia and Japan selling for $3-$5 at the higher end. The cost could also vary by service, with throwaway numbers for WhatsApp costing more than those for X.

SMALL NUMBERS OF NOTEPAD++ USERS REPORTING SECURITY WOES

Three organizations reported security incidents in which Notepad++ processes initiated access, allowing threat actors to gain hands-on keyboard activity and potentially exploit the application's update mechanism.

TRAINS CANCELLED OVER FAKE BRIDGE COLLAPSE IMAGE

COUPANG DATA BREACH TRACED TO EX-EMPLOYEE WHO RETAINED SYSTEM ACCESS

South Korea's largest retailer, Coupang, traced a 33.7 million customer data breach to a former employee who retained system access after leaving in 2024.

Try Asana for free →

PHYSICAL PRODUCTS ARE BACK

Digital fatigue is driving a resurgence in physical products as consumers seek tangible experiences. Americans check phones over 140 times a day, and ages 8-24 spend up to 56% of waking hours on screens. Yet 96% of digital detox attempts fail within a month. In response, markets like brand gifting, vinyl records, and collectible card games are growing rapidly. Other categories, such as board games, candles, and stationery, are also seeing increased adoption.

AI TOOLS COULD DRIVE $263 BILLION IN HOLIDAY SALES

Walmart, Target, and Etsy are adding AI assistants to help shoppers discover products, compare prices, and complete purchases. Shoppers using AI are 30% more likely to buy and spend 14% more time on sites, increasing revenue per session by 8%. Brands are updating product listings with detailed descriptions and solution-focused content to perform better in AI searches.

INSIDE PRODUCT HUNT'S COMMUNITY-LED GROWTH STRATEGY

Product Hunt grew by making community validation its main growth engine instead of paid or viral tactics. It focused on a curated audience of makers and early adopters, with 57% of traffic direct and most users aged 25-34, creating urgency through one-day launches and six-month relaunch limits. It scaled from 4,000 to 100,000 users by prioritizing density over scale, using invite-only access and active participation in comments. Community-led growth can outperform traditional GTM when identity and curation come first.

SHOULD YOU PITCH JOURNALISTS FROM AN AGENCY OR BRAND EMAIL ADDRESS?

Who a pitch is sent from changes how journalists engage. Agency addresses drive higher opens (41.5% vs. 35.7%) because agency-written subject lines are more urgent and emotionally compelling. Brand addresses drive about 60% more replies due to stronger perceived authority. The strongest results come from agencies sending pitches from brand domains, combining higher open rates with higher reply rates.

for free →

WE BUILT A FREE TOOL TO SEE EXACTLY WHAT CHATGPT SEARCHES

This free Chrome extension reveals the queries ChatGPT generates behind the scenes, giving SEOs insight into how AI interprets search intent. It intercepts fetch responses, extracts the hidden search_model_queries field, and displays the reformulated queries in a floating panel. It shows how ChatGPT removes filler words, adds context, and expands one prompt into multiple searches, helping SEOs match content to AI phrasing and discover new query variations. The extension runs locally, installs in about 2 minutes, and lets users copy queries or export history to CSV.

CREATE MARKETING CLIENT NOTEBOOKS WITH NOTEBOOKLM

Client notebooks in NotebookLM centralize all client context in one place. Each notebook should include sales notes, kickoff transcripts, home page copy, and the XML sitemap. It should also include materials that define the target audience, brand voice, and KPIs. Teams can use structured prompts in NotebookLM to extract goals, audience needs, and differentiators for SEO, copy, reporting, and sales.

WHY AI DOESN'T MEAN THE END OF FREEMIUM

AI does not kill freemium because users must experience value before paying. Freemium is the fastest way to teach new AI categories. AI products run on 20 to 40% margins versus 80% plus for traditional SaaS, so freemium should be treated as a marketing expense rather than a cost center. When the upgrade trigger happens after real value is felt, conversion follows, as shown by a 3 to 5% freemium to paid rate after users hit a clear usage limit. Freemium should continue after conversion through small free moments that sustain habits and drive word of mouth growth.

THE PSYCHOLOGY OF FEEDBACK DESIGN

The way performance scores are displayed influences how users perceive quality. Cumulative formats reduce the impact of negative feedback and support trust, while incremental formats highlight each rating and push accountability. When both are shown, users focus on the most extreme score, usually negative. Display formats can be adjusted by user type. New users benefit from progress visibility, while experienced ones prefer consistency. This approach can shape behavior without altering the data.

THE FUTURE OF SOCIAL LOOKS LIKE INTIMACY AT SCALE

Connection through storytelling defined Glossier's strongest moments this year. From GRWM routines to ASMR textures and mood-led creator content, the brand favored intimacy over polish. TikTok Shop reshaped how content supports commerce, while feedback loops with the community informed product evolution. Content was crafted to feel personal and immersive, even at scale. Glossier is now moving toward richer, serialized formats and physical experiences that build trust and reinforce the brand's cultural positioning.

6 TRENDS SHAPING THE NEW ERA OF SOCIAL MARKETING

4 TIPS TO WRITING THE BEST HEADLINES

The best headlines contradict themselves, admit fault, and flip assumptions on their head.

2026'S UPCOMING IMPORTANT SOCIAL MEDIA ROLE

Brands will start hiring a Culture and Social Listening Lead to stay ahead of fast-moving culture.

TRY WISPR FLOW FOR FREE →

OPENAI RELEASES GPT-5.2 AFTER “CODE RED” GOOGLE THREAT ALERT

GPT-5.2 has been released in three variants: Instant, Thinking, and Pro. 5.2 is designed to unlock more economic value for people. It features a 400,000-token context window and a knowledge cutoff date of August 31. GPT-5.1 will remain available in ChatGPT for paid users for three months. GPT-5.2 is OpenAI's third major model release since August.

GOOGLE ANNOUNCES EXPERIMENTAL ‘DISCO' BROWSER WITH ‘GENTABS' POWERED BY GEMINI 3

Google Labs' Disco browser features a Gemini 3-powered 'GenTab' that can build interactive web applications to help users complete tasks. It can look at open tabs and chat history to determine what tool best serves a prompt. Every generative element ties back to the web and will link to the original sources. The most compelling ideas from Disco may one day make their way into Chrome. A link to the waitlist to try Disco is available in the article.

RIVIAN ANNOUNCES NEW AI TECH, CHIP, AND ROBOTAXI AMBITIONS

Rivian has developed a custom chip, a car computer, and new artificial intelligence models to bring autonomous features to its vehicles. The company plans to roll out a subscription in early 2026 that will provide continuously expanding capabilities powered by Rivian Autonomy Processors and autonomy computers. A near-future update will include a 'Universal Hands-Free' capability that will enable Rivian customers to drive hands-free on more than 3.5 million miles of roads in North America.

AI HACKERS ARE COMING DANGEROUSLY CLOSE TO BEATING HUMANS

AI hacking tools are now surpassing some human hackers. Stanford's Artemis AI bot beat all except one of the 10 professional penetration testers in a test of its abilities. It found bugs at lightning speed while running at under $60 an hour. However, about 18% of the bugs it found were false positives. It also missed an obvious bug that most of the human testers spotted.

runs, 24-hour test maintenance, and zero flakes, teams like Drata

have achieved 86% FASTER QA CYCLES.

Schedule a demo to learn more →

COMPOUND ENGINEERING: HOW EVERY CODES WITH AGENTS

In traditional engineering, each feature makes the next feature harder to build because of new edge cases, interdependencies, and issues. In compound engineering, each feature makes the next feature easier to build because compound engineering creates a learning loop for agents and team members so that each bug, failed test, or insight gets documented and used by future agents. AI's knowledge of the codebase grows along with it, making future development work faster. This post provides a high-level sense of how to start compound engineering with AI.

AN SVG IS ALL YOU NEED

SVGs are vector graphics in a simple XML format. They are supported on almost every device and platform. With embeddable scripts to make them interactive, SVGs are way more capable than many people realize. It is entirely feasible to implement an entire data analysis pipeline in an SVG. A completely self-contained SVG file can fetch data from a versioned repository, process that data, and generate visualizations without any server-side magic required.