Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Researchers from ESET discovered a new WinRAR vulnerability that is being actively exploited in phishing campaigns. Unpatched versions of WinRAR and Windows versions of UnRAR, RAR, and UnRAR.dll can be tricked into using a path specified by a maliciously crafted archive file as the extraction directory. This vulnerability is being exploited by the Russian hacking group RomCom to install malware.
Security researchers discovered vulnerabilities in Lenovo 510 FHD and Performance FHD webcams that allow attackers to remotely transform them into BadUSB devices capable of injecting keystrokes and installing malware. The Linux-based webcams lack firmware validation, enabling complete compromise and persistent re-infection even after system wipes and OS reinstalls. Lenovo has released firmware version 4.8.0 to address the vulnerabilities following responsible disclosure in April.
Gareth Heyes of PortSwigger writes about his experience writing a Burp Suite AI extension to automate hunting for IDOR and similar vulnerabilities. The extension, Repeater Strike, scans requests and responses to generate regular expressions that can be used to identify vulnerabilities in your traffic. While the extension worked in small tests, the AI struggled with longer responses, creating regular expressions that aren't site specific, and detecting more complex vulnerabilities.
Researchers from DataDog discovered an attack vector where an attacker could abuse an Entra ID service principal (SP) with the Cloud Application Administrator or Application Administrator roles or the `Application.ReadWrite.All` permission to obtain global admin. The attacker uses the compromised SP to hijack the Office 365 Exchange Online SP to add a new federated domain, which they can then abuse to log in as any hybrid user. The researchers reported this vulnerability to Microsoft, but it was dismissed as a configuration issue.
Modern frameworks block most HTML XSS through automatic escaping, but XSS persists when developers bypass protections with WYSIWYG editors, markdown parsers, or flawed sanitizers. Frameworks don't guard against JavaScript XSS via URL attributes (href/src with javascript:) or eval in OAuth flows, redirects, or postMessage. Even trusted libraries may cause XSS if misused, and defenses like CSP and WAF are often bypassed, so developers must treat all input as untrusted and reliably use protections.
uBlock Origin Lite has been released for Safari on macOS and iOS following the discontinuation of the original uBlock Origin. uBlock Origin Lite provides best-in-class ad blocking without consuming CPU or memory resources.
VulnCheck-OSS created a GitHub repo archiving tens of thousands of exploits from 0day.today, a public exploit database that went offline in early 2025 and returned without its decade of data. The archive categorizes exploits (DoS, local, remote, shellcode, and web apps) with an index.json file for access, including metadata like CVEs, dates, and platforms. The project aims to prevent data loss and help security researchers use historical proof-of-concepts for analysis and detection.
Trelica by 1Password introduced an access review feature that automates SaaS user access audits across 350+ API integrations, custom applications via APIs, and non-SCIM apps through CSV uploads. It offers a standardized workflow with context (roles, access levels, and issues), automated reviewer notifications, and inline actions for deactivating users or updating permissions. Reviews produce exportable audit reports with reviewer details and notes to meet compliance standards like SOC 2, SOX, PCI DSS, and ISO 27001.
AWS has introduced the ability to create Bedrock API keys, which are special API keys that are explicitly scoped to Bedrock. Long-term API keys are tied to an automatically generated or existing IAM user, can be configured with an expiration of up to 100 years, and are composed of a magic 3-byte prefix, a human-readable section, and a base64-encoded secret. Short-term API keys are scoped to a specific user's session and have the format `bedrock-api-key-[BASE64]` where [BASE64] is a base64-encoded pre-signed URL.
Researchers from NeuralTrust demonstrated a jailbreak against GPT-5 using "Echo Chamber" and storytelling to bypass ethical guardrails, poisoning context to generate prohibited instructions without triggering refusals. Zenity Labs revealed "AgentFlayer" attacks exploiting ChatGPT Connectors, Cursor AI, and Microsoft Copilot via prompt injections in documents, tickets, or emails to exfiltrate data like API keys. These reveal how AI connected to external systems increases attack surfaces, with Tel-Aviv University showing smart home hijacking via poisoned calendar invites to Google's Gemini AI.
Brian Krebs will be featured in a new four-part HBO Max series about Finnish cybercriminal Julius Kivimäki, who was recently sentenced to over six years for extorting a psychotherapy clinic and its patients. The series explores Kivimäki's hacking career from age 14, including DDoS attacks, swatting, and blackmailing 22,000 therapy patients. Titled "Most Wanted: Teen Hacker," it will air weekly on Fridays throughout September across multiple regions.
The International Obfuscated C Code Contest (IOCCC) returned after 4 years with 23 winners showcasing deliberately cryptic code, including entries that abuse Unicode encoding to hide functionality and a 295-character program that displays the moon's current phase.
Germany's Constitutional Court ruled that police spyware for monitoring encrypted communications can only be used for serious crimes carrying maximum sentences of at least three years, citing the "very severe" privacy intrusion of such surveillance tools.
62% of consumers support brands speaking on social issues, yet only 46% can define DEI, and 18% think it pushes an agenda. LGBTQ+ consumers, with $3.9 trillion in global buying power, have higher expectations, with 61% wanting brands to share commitments compared to 35% of the general population. Perceived LGBTQ+ representation in ads has fallen from 73% in 2023 to 65% in 2025. Scaling back DEI reduces trust for 41% of consumers and impacts purchasing for 39%, especially among younger and LGBTQ+ audiences.
The protein trend is changing US restaurant menus. Currently, 28.4% of menus highlight protein, up from 5.9% a decade ago, and this could exceed 40% by 2029. Driven by health-conscious consumers, including younger generations and those using weight-loss drugs like GLP-1, restaurants like Starbucks, Smoothie King, and Panda Express are adding or promoting protein-rich options to boost sales.
Using a genuine smile in a profile picture can increase approachability and reduce perceived risk, leading to more sales. Consistently using the same photo across platforms leverages Familiarity Bias, making people more likely to trust and choose you. Research shows people make judgments about trust in milliseconds based on facial cues like an upturned mouth and slightly raised eyebrows. One study found people invested up to 42% more in strangers with trustworthy features.
AI will not kill SEO, but it will force it to evolve. Many marketers are wrongly chasing AI visibility tools instead of building strategies around user intent. SEO's purpose is to help people find answers, products, and services across any platform, whether it is a search engine or an AI agent. Ranking in AI responses is brand marketing and not a substitute for technical SEO and content that drives customers. The mentality needs to shift from gaming algorithms to optimizing for user needs and structured content that works across AI-driven search environments.
This webinar will explore how brands like Free People, Centrum, and RMS Beauty are using zero-party data to drive higher AOV, more conversions, and retention. It will discuss the tactics used, including interactive quizzes, guided experiences, and personalized journeys. The webinar takes place on August 12 at 10 AM PT.
These 4 AI prompts break complex tasks into focused steps. They automate building feature taxonomies from a user perspective, turn product strategies into persuasive narratives, and frame initiatives within the overall strategy to connect work to business goals. They also offer critical evaluation from a leadership view to identify risks and alignment issues. While product-focused, these prompts are useful for marketers involved in messaging and strategy, helping clarify features and craft compelling stories.
Vuori grew from a garage startup to a $5.5B brand in under 10 years by focusing on the overlooked men's premium activewear market. Rather than highlighting technical specs, it prioritized comfort and versatility, with fabrics like DreamKnit and BlissBlend driving word-of-mouth. A hybrid distribution model with partners like REI, Nordstrom, and Equinox built credibility and expanded reach while maintaining a premium image. Its success stems from redefining the category through cultural relevance, product innovation, and insight into how people want to live.
Relying on intuition over consumer data can harm branding, as seen when Tropicana's packaging change caused a 20% sales drop. A study of 405 brand elements from 50 brands found marketers often overestimate brand fame and underestimate uniqueness compared to consumer views. Research showed marketers were only slightly better at judging logos and were more accurate in groups than alone.
A ranking of the top 25 countries for online shopping, led by the US, China, and the UK.
This 6-step AI-assisted framework combines in-depth research, voice transcription, and iterative AI editing to create polished content.
Sponsored
Tomorrow kicks off CodeSecCon 2025 [4] — SecurityWeek's free two-day virtual event for developers who care about building secure, scalable apps.
A bug was introduced by a misplaced negation when handling user-agent headers in a C++ project. This mistake, caused by a copy-paste error while refactoring code to use "if scope" for error handling, resulted in user-agent data not being captured for a specific build. To clear up confusion for users and pinpoint the faulty data, the author added a visual "fingerprint" that represented the build's git commit hash to the reporting page, allowing users to quickly identify data affected by the buggy version.
The creator of OpenFreeMap was surprised to discover a massive surge in traffic, reaching 100,000 requests per second, due to a new collaborative drawing website called Wplace.live built on top of OpenFreeMap. This unexpected load caused some tiles to fail, but the service remarkably managed to handle most of the traffic. To help mitigate this traffic, they implemented a Cloudflare rule to limit Wplace.live's traffic and offered to help them set up their own self-hosted OpenFreeMap instance.
The design choices behind the Zig programming language's syntax makes it clear and consistent to use. It has prefix types, raw strings, and a uniform approach where everything is treated as an expression. Integer literals without suffixes, the removal of the arrow in function definitions, and the use of keywords to denote control flow, including boolean operators, are other features that are shown in this article that make it a useful language.
This dev has been structuring their sleep schedule around the five-hour reset time of their Claude Pro subscription to maximize its usage for their B2B SaaS project. Inspired by the sleep patterns of solo sailors, they've adopted a polyphasic sleep schedule, napping in short intervals to coincide with Claude's token usage limits. This has greatly increased their productivity, allowing them to ship features quickly.
Many companies waste time and fail to identify good candidates. Effective interviews are differentiated, applicable to the actual job, efficient with time, and make an assessment of the long-term value of the candidate. Live coding and take-home assignments are worse than work sample discussions and code reviews.
Having off-topic online spaces is important for building team camaraderie and improving productivity in remote work environments. A lack of informal online interaction negatively impacts team dynamics and work quality. Leadership must actively participate and cultivate a culture where off-topic communication is valued.
Sponsored
Clerk now supports theming via CSS variables and has a dedicated shadcn/ui theme that automatically matches your application's existing shadcn/ui theme configuration. Watch [12] as we walk you through how to style UI components.
Open Lovable allows users to instantly build React apps by chatting with AI. The project requires API keys from services like E2B and Firecrawl and, optionally, from AI providers like Anthropic, OpenAI, or Groq.
Bluefish is a JavaScript diagramming framework that lets users build complex, reactive diagrams using UI-like components and relationship-based layouts.
Flintlock is a service for creating and managing microVM lifecycles. It supports Cloud Hypervisor and Firecracker VMMs, which helps create microVMs on bare-metal hosts for use cases like virtualized Kubernetes clusters and isolated workloads. Flintlock also has API-driven functionalities for creating, deleting, and managing microVMs, configuring metadata, using OCI images, and exposing metrics.
This post compares OpenAI's new open-weight LLMs, gpt-oss-20b and gpt-oss-120b, with GPT-2 and Qwen3. There are architectural advances such as removing dropout, using RoPE for positional embeddings, incorporating Mixture-of-Experts, and more. The post also discusses the training process, reasoning abilities, optimization for single-GPU use, and benchmark performance of the gpt-oss models.
LLM-powered coding tools have a trivial learning curve, but won't magically produce production-ready code. These tools are great with well-established standards, integration tests, and bug fixing, especially in strongly-typed languages like Rust, but struggle with complex frontend development and introduce unnecessary code complexity. Stability is a concern, with pricing changes and frequent updates making them unreliable.
Tailscale is a WireGuard orchestration service that can connect devices and services. It has features like SSH support, MagicDNS, and the "funnel" and "serve" commands for exposing services. It's great for self-hosting enthusiasts.
Minifeed is a blog reader and search engine that curates human-written blogs, allowing users to discover, search, subscribe to, and save their favorite content.
A project displaying an interactive map of over one million website homepage screenshots.
This dev is not able to replicate the widely reported successes others have had with AI coding tools like GPTs and finds them unproductive despite their occasional usefulness for smaller tasks.
You can code with AI on a budget by using the free tiers of multiple AI models in a browser setup.
Sponsored
In a live webinar next Thursday [4], Sapient Insights will share their latest research showing HR leaders aren't just supporting tech decisions—they're shaping them. From AI governance to workforce alignment, HR is playing a key role in enterprise tech strategy.
OpenAI has announced GPT-5 in three variants: GPT-5 Pro, GPT-5 mini, and GPT-5 nano. Some of the models will be available across all ChatGPT, including for free users. OpenAI claims the new model family comes with reduced confabulations, improved coding capabilities, and a new approach to handling sensitive requests. Free users now have access to a simulated reasoning AI model. GPT-5 Pro is replacing o3-pro in ChatGPT for those subscriber tiers with access to it.
Meta's TBD Lab houses many of the researchers the company lured away from rival labs. It is spearheading Work on the newest version of Meta's large language model, Llama. The TBD Lab will work alongside Meta's other AI teams on a variety of projects. Meta has to date poached at least 18 researchers from OpenAI and a number from Google.
The US Food and Drug Administration has approved an eye drop that improves near vision in adults with presbyopia, a condition that causes near-sighted vision loss. The aceclidine-based eye drops offer relief from blurry near vision for up to 10 hours. They work by gently shrinking the pupil of the eye, creating a pinhole effect that helps bring nearby objects into sharper focus. The eyedrops do not significantly affect the eye's focusing muscles, so using them doesn't blur distance vision or cause myopic shift.
Eli Lilly has developed a new pill that causes obese people to lose significant amounts of weight. The drug targets GLP-1, potentially increasing access to GLP-1 medications due to price and ease of application. Its side effect profile is similar to that of the injectable GLP-1 drugs. Eli Lilly plans to file for approval for the drug by the end of the year.
Sponsored
ThreatSpike ditched underperforming channels like Google and LinkedIn for TLDR. The results?