Hackers target home routers to use as residential proxies, command-and-control servers, and botnets. Recent ASUS breaches demonstrate that backdoors can survive updates. These attacks often brute-force default passwords or exploit vulnerabilities, then install SSH backdoors. Defenses include disabling WAN management and SSH, changing default credentials, enabling automatic updates, and auditing configs for unauthorized access.
Android malware "Konfety" employs sophisticated evasion tactics, including dual-app deception (same package name for benign and malicious versions), ZIP-level tampering to break analysis tools, dynamic code loading with encrypted assets, stealth techniques such as icon hiding, and the use of the CaramelAds SDK for ad fraud.
Matanbuchus, a Malware-as-a-Service (MaaS) loader that has been active since 2021, has evolved to version 3.0 with enhanced capabilities. Recent campaigns have used Microsoft Teams impersonation and Quick Assist for deployment. Updates include improved communication protocols, in-memory stealth, enhanced obfuscation, indirect system calls, broader execution support, and enriched data collection targeting EDR controls.
The Go programming language has introduced native FIPS 140-3 compliance support directly into its standard library and `go` command, starting with Go 1.24. Developers can enable FIPS 140-3 mode by setting the `fips140=on` GODEBUG option (either as an environment variable or in go.mod), and can build against validated cryptographic modules using `GOFIPS140=v1.0.0 go build`. This native integration eliminates the need for unsupported third-party solutions, providing a seamless developer experience with cross-compilation support and no performance overhead from foreign function interfaces.
SSH-Snake is a tool designed to perform automatic network traversal using SSH private keys discovered on systems with the goal of creating a comprehensive map of the network and its dependencies.
Cloudflare blocked 7.3 million DDoS attacks in Q2 2025, including a record-breaking 7.3 Tb/s attack. Most attacks were small and brief, but intense attacks are increasing. Attackers are using increasingly powerful botnets and targeting new industries and countries.
Hackers are concealing malware in DNS records, particularly TXT records, by converting binary files to hexadecimal and splitting them across multiple subdomains. This technique evades security defenses as DNS traffic is often unmonitored and has been used to deliver malware like Joke Screenmate and malicious PowerShell scripts.
UK cybersecurity firm Adarma has entered administration, the UK equivalent of bankruptcy, after investor Livingbridge withdrew funding three months earlier due to major contract losses. All 173 employees were made redundant with immediate effect on July 14. The company struggled financially despite charging daily rates of £740-£2,380 and serving clients with a combined turnover of £150 billion.
A Chinese state-sponsored hacking group known as Salt Typhoon breached a U.S. Army National Guard network, stealing sensitive data, including passwords and network diagrams.
Google patched CVE-2025-6558, a high-severity sandbox escape vulnerability in Chrome's ANGLE graphics layer that was actively exploited by attackers, marking the fifth zero-day Chrome fix in 2025.
Co-op's CEO confirmed that hackers stole the personal data, including names, addresses, and contact details, of all 6.5 million customers during a cyberattack in April.
OpenAI plans to earn commissions from product sales completed directly within ChatGPT by integrating a checkout system into the platform. It partnered with Shopify in April and is testing ecommerce features that would let merchants fulfill orders inside ChatGPT, targeting revenue from free users. The move challenges Google's search and shopping dominance as users increasingly rely on chatbots for product discovery. Brands are also adapting with "AIO" strategies to influence product visibility in chatbot responses, raising concerns about AI-driven search preference and its impact on traditional advertising.
Many brands struggle to convert because their content and offers are misaligned. The ACOM framework solves this by connecting Audience, Content, Offer, and Moment. It helps you understand who you're speaking to, what they need to hear, what action you want them to take, and when they're most ready to take it. HubSpot uses this model to guide everything from blog posts to product launches, ensuring each piece of content drives toward a clear conversion goal.
Larger font sizes make numbers in ads seem more convincing and persuasive. In experiments, a lamp's price was judged 9.3% cheaper and a wine bottle 15% cheaper when the price appeared in a larger font. People also perceived product features as higher quality and were more willing to buy, such as being 25.9% more likely to buy a fitness tracker with a prominently sized “60m waterproof” feature. The effect does not hold for premium or well-known brands.
Many marketing teams struggle with one-way updates, unclear messaging, and missing context. To improve internal communication, create consistent messaging frameworks that provide clear, aligned language. Use a mix of formats like meetings, chats, emails, and check-ins to keep messages clear and top of mind. Train mid-level managers to deliver updates confidently. Use storytelling to explain the reasons behind changes and maintain transparency. Measure communication effectiveness with surveys and engagement data, then adjust tactics to keep your team aligned.
Google rolled out a Manage Subscriptions feature that lists active email senders and how often they reach a user's inbox. With just one click, users can unsubscribe without opening emails. This change puts frequency and engagement under direct scrutiny.
LinkedIn users have noticed older posts appearing at the top of their feeds, but the company says it's intentional. In mid-June, LinkedIn updated its algorithm to prioritize relevance alongside recency, aiming to ensure users don't miss meaningful updates like job changes or useful insights, even if they're not new. The algorithm considers factors like your activity history, relationships, and a post's potential to create opportunities. While power users saw the shift first, LinkedIn is still fine-tuning the balance.
With YouTube capturing nearly double Netflix's TV viewing time in the US, its creator-centric flywheel and free access model have made it a dominant force in entertainment. Netflix's reliance on expensive, hit-driven content limits its flexibility, while YouTube benefits from infinite scale and low risk. HBO Max is retrenching around the prestige HBO brand, prioritizing deep engagement over mass appeal.
Companies like Doist, Buffer, Intercom, Zapier, and Microsoft demonstrate that strong content cultures are built through deep product understanding, executive sponsorship, and cross-functional collaboration. At Doist, employees across departments contribute to content that reflects brand values like trust and transparency. Intercom's early blog posts came directly from its cofounder, while Buffer encourages engineers and support staff to spark ideas through low-friction systems. Lastly, Microsoft developed a formal program to train internal contributors and measure impact.
This dev successfully crawled a billion web pages in just over 24 hours on a budget of a few hundred dollars. The crawler was designed with politeness and fault-tolerance in mind, focusing on HTML content only and adhering to robots.txt rules. The system used a cluster of optimized nodes, each with its own Redis instance, fetcher processes, and parser processes, overcoming bottlenecks like parsing speed by using modern libraries and truncating page content.
Pinterest's engineering team encountered a performance issue while migrating their internal search system, Manas, to Kubernetes, where a small percentage of search requests experienced massive latency spikes. Through a process of elimination and profiling, they discovered that the monitoring tool cAdvisor was the culprit, specifically its default collection of the container_referenced_bytes metric. This metric invasively scanned and cleared page table entries, causing memory contention with Manas' memory-intensive search indices. Disabling the problematic metric in cAdvisor resolved the latency spikes.
You can manually create Git repositories by bypassing standard Git commands and directly manipulating the underlying Git objects. This post explains Git's internal workings, focusing on content addressable storage, commit objects, and tree objects, and walks through how to manually create file blobs, tree blobs, and commits.
This dev initially blocked all web crawlers using robots.txt to protect his data, but this inadvertently broke link previews on his LinkedIn posts. LinkedIn's bot couldn't access the necessary Open Graph meta tags to generate previews because it was blocked by the robots.txt file. To fix this, he updated his robots.txt to specifically allow the LinkedInBot to crawl his website.
This dev shifted to Python for AI development. His Python toolbox includes uv for package management, ruff for linting and formatting, and FastAPI for building APIs. For version control and infrastructure management, he uses GitHub Actions, Dependabot, Gitleaks, pre-commit hooks, Make, and Docker.
QA Wolf's [10] AI-native service gets web and mobile apps to 80% automated end-to-end test coverage in just 4 months. They build and maintain your automated test suite, plus provide unlimited parallel test runs.
Claude Code Router is a tool that allows devs to route Claude Code requests to different language models and customize requests while still using the official Claude Code infrastructure. It's configured via a `config.json` file, enabling routing based on factors like background tasks, reasoning needs, or context length to services like OpenRouter, DeepSeek, Ollama, Gemini, and Volcengine.
Firefox 141 will ship WebGPU on Windows, enabling high-performance web applications for games, visualization, and computation. This implementation, based on the Rust crate WGPU, follows the WebGPU and WGSL standards developed with Mozilla's participation.
EulerHS is a Haskell framework that makes the creation of concurrent backend and console applications easier. It has pre-integrated subsystems like SQL databases, logging, and KV databases.
The Pragmatic Engineer conducted a survey with nearly 3,000 tech workers to analyze the current tech landscape. The survey covered demographics, AI tools, programming languages, IDEs/terminals, version control, CI/CD, and cloud providers. It found that AI tools are rapidly gaining popularity, with GitHub Copilot leading and Cursor showing fast growth. TypeScript and Python are the most-used languages, while JIRA is the most-disliked tool.
2025.07.17·
newsletter.pragmaticengineer.com·29 min read·TLDR Web Dev
A "day-dreaming loop" (DDL) for LLMs might address their lack of novelty and insight. The DDL involves a background process that continuously samples concepts, explores connections, and filters for valuable ideas. This process, while computationally expensive, could kickstart more innovation and generate proprietary training data.
InstantDB provides agents with full-stack backends, including databases, sync engines, and auth tools, to make the creation of applications easier. Agents and humans benefit from built-in abstractions, cost-efficient hosting, and exposed data.
"Gaslight-driven development" is a new trend where AI language models subtly influence API design by consistently suggesting certain features or methods, leading developers to implement them even if they weren't initially planned.
After transitioning from a hands-on role to a leadership position, this person feels more and more irrelevant, grappling with the lack of visible impact and recognition despite enabling their team's success.
Vibe coding makes developers slower, despite their perception of increased productivity, so devs should use AI as a tool to improve their existing skills and focus on mastering the fundamentals of programming.
Big Sleep is an AI agent developed by Google DeepMind and Google Project Zero that actively searches and finds unknown security vulnerabilities in software. It recently helped Google detect and foil an imminent exploit - possibly a first for an AI agent. Big Sleep is being deployed to help improve the security of widely used open-source projects. AI cybersecurity agents will help free up security teams so they can focus on high-complexity threats, dramatically scaling their impact and reach.
Calvin French-Owen joined OpenAI in May 2024 and left the company three weeks ago. This post shares a first-hand account of what the culture of working at the company actually feels like. It covers how the company operates without giving away any trade secrets. OpenAI grew quickly from a group of scientists and tinkerers investigating the cutting edge of science into an organization with the most viral consumer app in history and ambitions to sell to governments and enterprises, making it one of the most fascinating organizations in history at an extremely interesting time.
Airbus' Acubed and Google spinout SandboxAQ are developing an alternative to GPS. Its quantum sensing technology is now inching closer to commercialization. The MagNav quantum-sensing device uses quantum physics to measure the unique magnetic signatures at various points in the Earth's crust. An AI algorithm is then used to match those signatures to an exact location. The technology could be a promising alternative to GPS in a time when GPS jamming and spoofing are on the rise.
Researchers at the National Institute of Standards and Technology (NIST) have improved their atomic clock so it can perform timekeeping with 19 decimal places of accuracy. The aluminum ion clock is 2.6 times more stable than any other ion clock. Its accuracy will help facilitate new scientific and technological advances, allowing scientists to explore new concepts in quantum physics and build the tools needed for quantum technology. It could help physicists explore physics beyond the Standard Model, such as the possibility that the fundamental constants of nature are not fixed values but actually changing.
When AI experiments work great in dev but fail in production, it's often an observability problem. In a recent fireside chat, Google's Director of AI and Datadog's VP of Engineering shared 7 key insights [13] for building production LLMs on Google Cloud. Get the ebook now