Search the archive

FINDING LEVERAGE [THEORY OF CONSTRAINTS]

Working harder on the wrong thing is why you're stuck - systems move at the speed of their slowest part.

WHAT FOUNDERS SHOULD NEVER SIGN, AND HOW TO PUSH BACK WITHOUT KILLING THE DEAL

Good investors expect pushback - accepting garbage terms makes you look clueless.

FIGMA AIMS AT $16.4 BILLION VALUATION AS TECH IPOS BOUNCE BACK

Figma is targeting a $16.4 billion valuation in its NYSE IPO, aiming to raise up to $1.03 billion by selling shares between $25 and $28.

To tackle this problem, check out 1Password's on-demand webinar

that explores how IT and security teams can:

INSURANCE GIANT SAYS MOST US CUSTOMER DATA STOLEN IN CYBER-ATTACK

Hackers breached Allianz Life's third-party cloud-based CRM system on July 16, using social engineering techniques to steal personal data from approximately 1.4 million of the insurer's North American customers. The German parent company immediately contained the breach, notified the FBI, and confirmed no other company systems were compromised.

DATING SAFETY APP TEA BREACHED, EXPOSING 72,000 USER IMAGES

Tea, an app for anonymous dating reviews, suffered a data breach exposing 72,000 images, including 13,000 verification selfies and IDs. The breach affected users who signed up before February 2024. 4chan users reportedly shared the stolen data, coinciding with Tea's surge in viral popularity.

POST SMTP PLUGIN FLAW EXPOSES 200K WORDPRESS SITES TO HIJACKING ATTACKS

A critical security vulnerability (CVE-2025-24000) in the Post SMTP WordPress plugin allows low-privileged users to access email logs and hijack administrator accounts by intercepting password reset emails. The flaw affects all versions up to 3.2.0 and stems from broken access controls that only checked if users were logged in without verifying their permission levels. Despite a fix being released in version 3.3.0 on June 11, over 200,000 WordPress sites remain vulnerable, as more than half of users haven't updated their plugin.

HOW WE ROOTED COPILOT

Microsoft's Copilot Enterprise Python sandbox vulnerability allowed researchers to gain root access within the container through a PATH hijacking attack in the keepAliveJupyterSvc.sh script, which executed `pgrep` without a full path every 2 seconds. Researchers exploited this by placing a malicious script in /app/miniconda/bin, which was writable by the ubuntu user and prioritized in $PATH, to execute arbitrary commands as root. While container breakout proved impossible due to patching, the vulnerability demonstrated how improper PATH handling in privileged scripts can lead to privilege escalation even in sandboxed environments.

OSS-FUZZ INTEGRATIONS VIA AGENT-BASED BUILD GENERATION

OSS-Fuzz-Gen introduced an agent-based LLM approach that automatically generates build scripts and fuzzing harnesses for integrating projects into OSS-Fuzz, using iterative command execution and environment exploration to handle diverse C/C++ codebases. The system achieved 88 successful integrations from 225 tested repositories, demonstrating its ability to handle complex builds that require custom tools and dependencies. Key limitations include build scripts that avoid target source code or only support single-harness compilation, requiring post-processing validation improvements.

AI AND SECURE CODE GENERATION

The emergence of LLMs and coding agents fundamentally transforms application security, as AI now both writes and debugs code. As LLMs advance, humans will focus more on prioritizing vulnerabilities, providing additional context, and assessing exploitability. The vulnerability disclosure process will also become much quicker, with LLMs rapidly identifying vulnerabilities and offensive and defensive teams promptly collaborating to evaluate exploitability.

Get the Report

AI-WATERMARK

UnMarker is designed to be the first universal attack against defensive watermarking, which is used to detect AI-generated deepfakes. The attack disrupts watermarks in image spectral amplitudes without requiring detector feedback or knowledge of the scheme, thereby defeating both traditional and advanced semantic watermarking systems and rendering deepfake detection ineffective.

HERODEVS (PRODUCT LAUNCH)

HeroDevs provides commercial licenses to over 30 Never-Ending Support (NES) products, which are patched versions of software that organizations already use, behave identically, and are compatible with modern browsers and key third-party libraries.

HYPNUS

hypnus is a Rust library for memory obfuscation designed to protect memory regions during inactivity or sleep periods.

AFTER BLACKSUIT IS TAKEN DOWN, NEW RANSOMWARE GROUP CHAOS EMERGES

International law enforcement's Operation CheckMate dismantled the BlackSuit ransomware group, but a new group called "Chaos" quickly emerged, likely comprising former BlackSuit members. Chaos is targeting major organizations primarily in the US, demanding ransoms of around $300,000.

SCATTERED SPIDER IS RUNNING A VMWARE ESXI HACKING SPREE

Scattered Spider is targeting VMware ESXi hypervisors across retail, airline, transportation, and insurance sectors using social engineering to impersonate employees and trick IT help desks into resetting passwords for privileged accounts. Once they gain vCenter access, attackers enable SSH on ESXi hosts, perform "disk-swap" attacks to extract the NTDS.dit Active Directory database, wipe backups, and deploy ransomware to encrypt all VMs in the datastores. Google recommends hardening vSphere with execInstalledOnly, VM encryption, disabled SSH, phishing-resistant MFA, isolating Tier 0 assets, and centralizing logs in a SIEM to detect suspicious vCenter logins and configuration changes.

ANNOUNCING CHAINGUARD LIBRARIES FOR PYTHON: MALWARE-RESISTANT DEPENDENCIES BUILT SECURELY FROM SOURCE

Chainguard's Libraries for Python is a secure index that rebuilds Python packages and their dependency trees from source within a Supply-chain Levels for Software Artifacts (SLSA) Level 2-hardened setup to prevent supply chain threats. The platform specifically addresses Python wheels with native code and re-bundled OS libraries, such as OpenSSL, which create "software dark matter" that is hidden from SCA scanners. Early testing indicates that 98% of known malicious packages would be identified and blocked. This development follows notable incidents in 2023 and 2024 that involved attacks on PyTorch and Ultralytics YOLO where compromised builds and leaked API tokens facilitated malware distribution via PyPI.

DOGE TURNS TO AI TO DECIDE WHICH FEDERAL REGULATIONS TO CUT

The Trump administration plans to utilize an AI tool called the "Doge AI Deregulation Decision Tool" to analyze 200,000 federal regulations and eliminate half of them by January, aiming to save trillions in compliance costs.

RESEARCHERS EXPOSE MASSIVE ONLINE FAKE CURRENCY OPERATION IN INDIA

CloudSEK researchers used facial recognition and GPS data to expose a $2 million counterfeit currency operation in India, identifying over 750 social media accounts selling fake notes and pinpointing key perpetrators in Maharashtra.

👉 Peak inside the AI growth engine we built for unicorns →

$10K–$60K/MONTH TO ACCESS.

This is normally something we charge $200 per session, _BUT FOR TL;DR;

MARKETING CONCERNS OVER AI SEARCH MAY BE OVERBLOWN, STUDY FINDS

Most marketers are not seeing major traffic losses from AI Overviews, with 55.5% reporting traffic increases and only 8.3% seeing declines. Many have already adapted, with 57% modifying SEO or content strategies, and 54.5% diversifying channels like email and paid social. 68% of marketers focus on tracking AI search visibility in ChatGPT rather than Google's AI Overviews due to its clearer referral data. Brand mentions and technical strategies like schema markup, E-E-A-T, and clear content formatting are now central to visibility.

SOCIAL MEDIA CAPTURES MAJORITY OF DIGITAL ATTENTION AS VIDEO OUTPACES TV

Internet users now spend 13 hours and 48 minutes per week on social media, 35% more than time spent watching TV. Short-form video leads the way, accounting for 6 hours and 42 minutes weekly, surpassing both long-form video and traditional television. Among women aged 16-24, social media usage is 2.6X higher than TV viewing. YouTube tops mobile app usage and web traffic, while 22.3% of adults globally report using ChatGPT, with adoption reaching over 40% in countries like Kenya and Israel.

HOW TO MAKE COMPETITORS LOOK LIKE ALIENS

The best companies avoid direct feature comparisons with competitors and instead reframe the conversation by positioning themselves as solving entirely different problems. Asana, Superhuman, and ClickUp use analogies that place competitors in narrow roles while casting themselves as broader solutions. Good messaging defines competitors in small, accurate terms and presents the company as a more expansive, transformational option. Use templates like Tool vs. Platform or Past vs. Future to build this positioning.

SHOULD MY COMPANY INVEST IN A REDDIT STRATEGY?

Reddit is more than an SEO tool. It's a major data source for LLMs, meaning authentic content can shape how AI platforms understand and present your brand. Unlike paid ads, Reddit relies on genuine community engagement. Effective use means listening first, contributing meaningfully, tracking mentions, and avoiding shortcuts. Companies should join existing conversations rather than starting new subreddits and ensure someone on the team can engage authentically.

FREE INTERNAL AI PLAYBOOKS

A list of 8 AI playbooks from OpenAI, Google, and Anthropic.

HOW WE ROOTED COPILOT

Eye Security researchers discovered a vulnerability in Microsoft's Copilot Enterprise that allowed code execution in a live Python sandbox. By exploiting the ability to run Jupyter Notebook commands, they got root access within the container by poisoning the `pgrep` command, but found limited ways to use this privilege due to security mitigations. They reported the issue to Microsoft, which fixed it as a moderate-severity vulnerability, and were acknowledged for their research.

PERFORMANCE AND TELEMETRY ANALYSIS OF TRAE IDE: A DEEP DIVE INTO BYTEDANCE'S VSCODE FORK

Trae IDE, a ByteDance fork of VSCode, has some issues. It consumes more resources than VSCode, with up to 6 times the memory usage and a much higher process count. Telemetry data is persistently transmitted to ByteDance servers, even when telemetry settings are disabled by the user, collecting granular system and usage information.

NEVER WRITE YOUR OWN DATE PARSING LIBRARY

The creator of Eleventy started replacing the Luxon date parsing library due to its large size. He explored alternatives like dayjs but found them inaccurate, leading him to create a new RFC 9557-compatible library called `@11ty/parse-date-strings`. This new library offers a smaller bundle size and prepares Eleventy for future native Temporal API support.

IT'S TIME FOR MODERN CSS TO KILL THE SPA

Modern CSS features like View Transitions and Speculation Rules have made Single Page Applications (SPAs) obsolete. SPAs were initially adopted to create smoother, app-like navigation, but they often result in performance issues and unnecessary complexity.

DO NOT DOWNLOAD THE APP, USE THE WEBSITE

Don't download apps when websites offer the same functionality. Apps can access contacts, location, microphone, and installed apps - information that websites struggle to obtain.

Schedule a demo to learn more

VANILLA JAVASCRIPT SUPPORT FOR TAILWIND PLUS

Tailwind Plus now offers full Vanilla JavaScript support for its UI blocks through a new library called `@tailwindplus/elements`. This library provides headless custom elements that handle complex UI behaviors without requiring a JavaScript framework.

ES-TOOLKIT

ES-Toolkit is a high-performance JavaScript utility library designed to replace lodash with better speed and smaller bundle size. It has various utility functions with modern implementations and supports tree shaking and TypeScript out of the box.

RUST RUNNING ON EVERY GPU

A Rust developer has created a demo allowing a single Rust codebase to run on various GPU platforms, including CUDA, SPIR-V, Metal, DirectX 12, WebGPU, and even CPU fallback. This removes the need for specialized shader languages, letting standard Rust code be directly compiled for GPU targets. The project uses Rust GPU, Rust CUDA, and Naga to bridge different graphics backends and compile kernels to appropriate device formats.

PROGRAMMING VEHICLES IN GAMES

Vehicle simulation can be broken down into three core components: the engine/gearbox, the tires, and the chassis. It's important to understand both the mechanical aspects and the desired driving experience. This article goes into the intricacies of tire modeling, including slip ratio, slip angle, and the friction circle, offering code examples and visual aids.

THE FUTURE IS NOT SELF-HOSTED

Relying on corporate cloud services means we don't truly own our digital content, but instead rent it. This dev built his own home server as an alternative, but realized self-hosting is impractical and isolating. Instead, he proposes community-hosted cloud services funded publicly.

FONT-SIZE-ADJUST IS USEFUL

The CSS `font-size-adjust` property with a fixed value normalizes font sizes across different fonts on a webpage.

MAKING POSTGRES 42,000X SLOWER BECAUSE I AM UNEMPLOYED

A web dev shows how they successfully made a Postgres database 42,000 times slower by tweaking configuration parameters in `postgresql.conf`, focusing on disabling caching, maximizing background processes, reducing WAL efficiency, essentially deleting indexes and forcing single-threaded I/O.

WINDSURF EMPLOYEE #2: I WAS GIVEN A PAYOUT OF ONLY 1% WHAT MY SHARES WERE WORTH

Prem Qu Nair explains his decision to join Cognition, the company that created AI software engineer Devin, despite a significant financial loss from forfeiting vested shares at his previous company, Windsurf, due to a time-sensitive offer from Google DeepMind.

THE MANY, MANY, MANY JAVASCRIPT RUNTIMES OF THE LAST DECADE

The JavaScript ecosystem has exploded in the last decade with numerous runtimes and engines optimized for environments like edge computing, microcontrollers, and native applications, reflecting a shift from browser-centricity to execution everywhere.

OPENAI GPT-5 IS COMING EARLY NEXT MONTH

OpenAI expects to release GPT-5 in August. GPT-5 is expected to combine the attributes of both traditional models and so-called reasoning models, such as o3, and be better at coding and more powerful overall. The OpenAI model that recently achieved gold medal performance in the International Mathematical Olympiad will not be included in GPT-5. GPT-5 will be launched with mini and nano versions and will be available through OpenAI's API.

GOOGLE ‘WEB GUIDE' LAB USES AI TO ORGANIZE THE SEARCH RESULTS PAGE

Google's Web Guide feature is designed to better organize Search results into categories with additional context and insights to make it easier to find information and web pages. It uses a custom version of Gemini that uses a query fan-out technique to perform multiple related searches to identify the most relevant results. The feature is ideal for both open-ended searches and detailed queries with multiple sentences. Web Guide is available in Search Labs.

COULD DOWN SYNDROME BE ELIMINATED? JAPANESE SCIENTISTS USE CRISPR TO TARGET EXTRA CHROMOSOME

Japanese researchers used CRISPR-Cas9 to remove an extra copy of chromosome 21 from affected cells in a laboratory setting. The scientific milestone could reshape future approaches to treating Down syndrome. The CRISPR system targets the extra chromosome without affecting the normal pair. If the technique proves safe and reliable, it could be used in regenerative medicine.

ROBOTIC NECK INCISION REPLACES HEART VALVE WITH NO CHEST OPENING IN WORLD FIRST

Doctors at the Cleveland Clinic replaced heart valves through a small neck incision using robotic assistance, avoiding the need to open the chest. Four patients have so far undergone the procedure, called transcervical robotic access for aortic valve replacement, and were discharged within days, with one even resuming gym workouts just a week after surgery. The procedure is being performed exclusively at the Cleveland Clinic for now, but the team hopes to standardize it for use at other highly specialized centers. It could redefine what is possible for heart surgery.