Cisco Talos reported 5 vulnerabilities to Broadcom and Dell affecting the ControlVault3 firmware and its associated Windows APIs. Dell ControlVault is a hardware-based Unified Security Hub (USH) that connects various security peripherals, such as fingerprint readers, smart card readers, and NFC readers, to function as a vault for storing passwords, biometric templates, and security codes. These vulnerabilities include a remote code execution vulnerability that could allow non-administrative users to read data off the ControlVault firmware or store an implant on it, as well as a vulnerability in which a physical attacker could access the USH board without requiring a login.
2025.08.07·blog.talosintelligence.com·4 min read·TLDR InfoSec C4 (Chrome Cookie Cipher Cracker) is a technique that defeats Google's AppBound Cookie Encryption, which was introduced in July 2024 to protect against infostealers. The attack exploits a padding oracle vulnerability to decrypt cookies as a low-privileged user, ironically turning Chrome's security feature into an attack vector for accessing SYSTEM-level data on Windows machines. New security implementations can inadvertently create novel attack surfaces when not properly hardened against cryptographic vulnerabilities.
Modern adversaries focus on appearing believable rather than staying hidden, using techniques like process impersonation, legitimate parent-child relationships, and contextually appropriate command-line arguments to blend into everyday operations. Deception can be categorized into visual (fooling human analysts), logical (passing reasoning checks), and behavioral (mimicking legitimate timing and patterns) verisimilitude layers. Detection strategies must shift from pure anomaly detection to plausibility-based approaches that question whether actions make contextual sense for specific users, systems, and operational environments.
KubeForenSys is a tool for collecting Kubernetes cluster data and ingesting it into Azure Log Analytics for analysis post-compromise.
Kanvas is an Incident Response (IR) case management tool with an intuitive, Python-based desktop interface.
Promptfoo embeds automated red-team tests into the build and release processes, provides actionable guidance for the identified issues, and feeds the results into the organization's existing vulnerability management workflows.
Insikt Group identified new infrastructure associated with the Israeli-backed Candiru spyware. Candiru developed a spyware called DevilsTongue, which is a Windows-based spyware with user and kernel-mode components that maintains persistence via COM hijacking to enable deep access to victim devices, enabling file extraction, browser data collection, and theft of encrypted messages. Insikt Group has identified five active clusters linked to infrastructure in Hungary and Saudi Arabia.
Microsoft Project Ire is an AI system designed to reverse-engineer and identify malicious software autonomously. Project Ire automatically dissects software files to understand how they work, what they do, and whether they're dangerous without any clues as to the software's origin or purpose. Microsoft's testing showed Project Ire to have a 98% true positive rate on detecting malicious files.
WhatsApp deleted 6.8 million accounts linked to global criminal scam centers, mainly from Cambodia, in the first half of 2025. Meta, in partnership with OpenAI, disrupted these campaigns and is introducing new WhatsApp safety tools to curb scams and protect users worldwide.
Google Threat Intelligence Group (GTIG) said that one of its Salesforce database systems was breached by the ShinyHunters hacking group, but the accessed data was confined to basic and largely publicly available business information.
Microsoft paid $17 million in bug bounties to 344 security researchers across 59 countries in the past year, its highest annual payout since 2018.
The TeaOnHer dating app exposed 53,000 users' private data, including selfies and driver's licenses, due to exposed admin credentials, highlighting the security risks of copycat applications that rapidly gain popularity without proper security controls.
Influencer fees are becoming unpredictable, as quotes for similar work can vary by up to 50%. Top influencers can charge $100,000 per post while mid-tier creators are doubling their rates, which is driven by rising demand and payment processor fee hikes. Brands are committing millions annually to creator agencies and consequently face increasing pressure to justify the costs amid tightening budgets. In response, marketers are adopting AI tools and pushing for industry-wide standards to bring transparency and stability to pricing.
Advertising made up 21.9% of total US economic output last year, generating $10.4T in sales. It supported 29M of the country's 158.1M jobs, or 18.3% of the workforce. Job shares ranged from 14.1% to 19.7% across all 50 states. Every $1M in ad spend supported 59 jobs, with an average salary of over $93K, which is 26% higher than the national average.
A basic MailerLite pop-up that annoyed existing subscribers was replaced with Digioh, a more sophisticated tool offering targeting based on UTM parameters, user behavior, and URL rules. Visitors arriving with utm_source=newsletter were excluded from seeing the pop-up, which was redesigned as a multi-step form that first asked for the visitor's role before requesting their email. This made the experience less intrusive and enabled better personalization. Additional settings controlled when and how often the pop-up appeared and excluded specific pages, resulting in fewer complaints, richer data collection, and better-targeted future email campaigns.
Ads are more effective when the model's eye contact matches the product type. For functional or emotionally negative products, having the model look directly at the viewer increases effectiveness, as seen in a 12% boost for a cafe ad and a 40% increase in sign-ups for an anti-smoking ad. For pleasurable products, a model looking away leads to higher engagement, such as a 30% rise in sunhat sales and a 19% improvement in watch ad ratings. Direct gaze builds trust and credibility, while averted gaze helps viewers imagine themselves using the product.
Over 85% of guest post sites are low quality, with weak traffic and DR, yet still command high prices. Only 4.6% of sites qualify as high-quality or top-tier, and those links can cost $692 to $957 before vendor markups, which can raise prices to $2,800 or more. Relevance is more important than metrics like DR, but there is no industry standard to measure it. News and media dominate the marketplace with the highest number of quality links, but also the most low-quality ones. Meanwhile, Digital PR provides more credible links, better long-term value, and ultimately higher ROI.
YouTube is testing a co-authoring feature that allows multiple creators to be visibly credited on a single video, similar to Instagram Collabs and TikTok's dual uploads. The feature includes clickable collaborator avatars next to video titles and uses a consent-based invite system to prevent unwanted tagging. This update aims to help smaller creators grow by gaining exposure through partnerships with larger channels, boosting discoverability and algorithmic visibility. YouTube may expand the feature to include shared analytics and revenue insights depending on user feedback.
Instagram's new features enhance connections with friends through reposts, a location-sharing map, and a Friends tab in Reels. Public reels and posts can be reposted, appearing in friends' feeds and on the user's profile. The Instagram map allows location sharing with selected friends and exploration of location-tagged content. The Friends tab displays reels liked, created, or shared by friends, making it easy to see their interests and start conversations.
A fake SEO term tested across AI tools revealed that ChatGPT Plus and Perplexity rely heavily on Google-indexed pages for generating answers. Marketers should treat Google indexation as a gateway to AI visibility. If content isn't indexed by Google, it likely won't appear in ChatGPT, Perplexity, or Gemini. It is critical to SEO strategy beyond SERPs to account for AI tools that are gaining traction.
Gen Z is redefining coffee consumption by transforming single origin pods into curated lifestyle products. Up-and-coming brands like K'WA are applying drop culture tactics to create scarcity, elevate packaging, and integrate multimedia content. For marketers, this signals a shift where ritual, design, and cultural alignment are essential to creating product relevance and buzz. Traditional messaging is losing ground to experience-led branding that enables social sharing and drives virality.
A visual guide to using different Instagram formats to engage your audience.
3 ways to use Reddit as a marketer.
A graph that maps how to run organic, paid, and influencer content together.
Sponsored
When you're just starting out, you're barely testing at all. As you start to think more about scale and rigor, tests become more habitual. As your code and team mature, testing becomes a way of life.
Cardog built the world's fastest VIN decoder by optimizing the NHTSA's VPIC database, which contains 40 years of vehicle data but doesn't have performance optimization. It achieved this by stripping regulatory metadata, removing unused patterns, and applying modern SQLite optimization techniques, reducing the database size from 1.5GB to 21MB. This resulted in a huge performance improvement, with response times decreasing from 3.2 seconds to under 30ms and eliminating network dependency.
hyperpb is a new high-performance and runtime-dynamic Protobuf parsing library for Go. It uses a dynamic approach, compiling code at runtime to enable online profile-guided optimization for parsing efficiency. This article goes over its architecture, focusing on its VM-based parser, memory management, and unique optimizations like zerocopy strings and arena reuse.
AI is not reinventing developers, and adopting AI tools is not the only path to success. It's important that devs have the freedom to choose their own tools and approaches. Software development is more than just generating code quickly - it requires understanding problems, designing solutions, and making architectural decisions.
The DOM and CSS are outdated and inefficient for modern web apps due to their complexity, legacy issues, and the blurring of UI and content. Common problems include the stringly-typed nature of the DOM, CSS' inside-out approach to layout, and the inadequacy of text manipulation APIs. Alternatives like "HTML in Canvas" and GPU-based renderers are promising to look into.
Modern CSS features like the View Transitions API and Speculation Rules have made Single Page Applications (SPAs) largely unnecessary by enabling smooth page transitions and instant navigation without requiring heavy JavaScript frameworks. While SPAs were originally adopted to create app-like experiences, browsers can now do what SPAs do natively with simple CSS.
Claude Code IDE for Emacs is an integration that allows the Claude Code CLI to interact with Emacs' features through the Model Context Protocol (MCP). It provides a bidirectional bridge enabling Claude to understand and leverage Emacs functionalities like LSP, project management, and custom Elisp functions. The IDE comes with automatic project detection, terminal integration, MCP tool support for accessing Emacs commands, diagnostic integration, and advanced diff views.
The ElevenLabs Conversational AI SDK allows devs to integrate interactive voice agents into React Native applications. It requires React Native with LiveKit dependencies, microphone permissions, and development builds for Expo compatibility.
StaticSearch is a client-side JavaScript search engine designed for static websites. It indexes website content to create JSON and JavaScript data files for search functionality. The engine has a web component for easy integration, along with modules and APIs for more customized implementations.
This article teaches the basics of GPU driver architecture, focusing on the user-mode driver (UMD) and kernel-mode driver (KMD) relationship using an example of rendering a rotating cube with Vulkan (VkCube). The UMD translates high-level API commands into lower-level GPU instructions, while the KMD manages memory allocation, job scheduling, and hardware initialization. The Tyr driver, a Rust-based KMD, provides an interface for device information, memory management, job submission, and tiler heap management.
There are many hidden complexities of building billing systems, far beyond simple subscription models. Billing involves managing various pricing models, real-time usage tracking, and adapting to changing needs. Billing is not just invoicing, but a critical infrastructure that impacts the entire business, so it often requires a specialized team with expertise in both engineering and finance.
2025.08.07·links.tldrnewsletter.com·10 min read·TLDR Web Dev Jules, an asynchronous coding agent powered by Gemini 2.5, is now open to the public.
AI-powered search features on Google are leading to more user queries and a higher quality of clicks to websites, still in the range of billions of clicks a day.
JavaScript's logical assignment operators (`||=`, `&&=`, `??=`) offer concise syntax for conditionally assigning values based on logical checks (falsy, truthy, or nullish).
Pgline is a high-performance TypeScript PostgreSQL driver for Node.js using pipeline mode with faster speed and lower CPU usage in benchmarks compared to Bun SQL, Postgres.js, and node-postgres.
Sponsored
Manual testing on mobile devices is TOO SLOW AND TOO LIMITED. It forces teams to CUT RELEASES A WEEK EARLY just to test before submitting them to app stores. And without broad device coverage, issues slip through.
* QA cycles reduced to just 15 minutes * Multi-device + gesture interactions fully supported * Reliable test execution with zero flakes * Human-verified bug reports
Anthropic's new model, Opus 4.1, is more capable at coding, research, and data analysis and better at fielding complex multistep problems than previous versions. It can better navigate large codebases and make more precise modifications to code. Opus 4.1 scores two percentage points higher than its predecessor on SWE-Bench Verified, a popular coding evaluation benchmark. Anthropic is currently finalizing a deal to raise as much as $5 billion in a new funding round at a valuation of $170 billion.
2025.08.06·bloomberg.com·2 min read·TLDR OpenAI's long-awaited open weight models have been released. The 120B model achieves near-party with OpenAI o4-mini on core reasoning benchmarks while running efficiently on a single 80 GB GPU. The 20B model delivers similar results to OpenAI o3-mini on common benchmarks and can run on edge devices with just 16 GB of memory. Both models are mixture-of-experts. It is likely that OpenAI now offers the best available open weights models.
2025.08.06·simonwillison.net·15 min read·TLDR Ozempic demonstrated remarkable anti-agent effects in a randomized controlled trial involving 108 people with HIV-associated lipohypertrophy, a condition characterized by excess fat accumulation and accelerated cellular aging. The researchers used epigenetic clocks to assess biological aging and found that those on semaglutide became 3.1 years biologically younger on average by the end of the study. The anti-aging effects weren't uniform across all body systems - the most dramatic improvements occurred in the inflammatory system and brain. The researchers believe that the anti-aging properties of semaglutide stem from its effects on fat distribution and metabolic health.
2025.08.06·trial.medpath.com·3 min read·TLDR Microplastics are everywhere. Studies show that microplastic burden strongly correlates with negative health outcomes. This post presents an experimental protocol that tricks cells into releasing microplastics back into the blood, where they can be transported to the liver for biliary excretion or actively removed with plasma exchange. It involves using a compound derived from broccoli as a microplastics mobilizer.
2025.08.06·jonbrudvig.substack.com·17 min read·TLDR Sponsored
Over 18 million people have turned to Simple—a science-backed app that combines intermittent fasting with AI coaching [13] (Avo™) to support sustainable weight loss, no restrictive diets required. Designed for busy techies who prefer data-driven solutions over calorie counting.
stagewise is a frontend coding agent for production codebases. Developers just have to tell the agent what they want to change, click on elements to let the agent know where a change should happen, and then stagewise does the rest. stagewise can be customized with plugins, and it is compatible with all kinds of frameworks. It features a dedicated frontend agent, but developers can use any other compatible agent through stagewise's open agent interface.
2025.08.06·github.com·GitHub repository·TLDR