Search the archive

THE DEATH OF "AI WON'T TOUCH ENTERPRISE SALES"

The sales game just got completely rewritten, and most people don't realize it yet.

HOW COMMON IS MULTIPLE INVENTION?

Big problems attract smart people who all have access to the same tools and knowledge.

🙋♀️ Get a guided tour with an expert

Inbound security reviews don't have to slow you down. SafeBase

helps you automate inbound requests, streamline questionnaires, and share your security posture proactively—all through a centralized Trust Center and AI Questionnaire Assistance.

ATOMIC MACOS INFOSTEALER ADDS BACKDOOR FOR PERSISTENT ATTACKS

Malware analysts discovered a new version of the Atomic macOS (AMOS) infostealer, which includes a backdoor that offers attackers persistent access to compromised systems. The new version of the malware features an embedded backdoor, utilizes LackDaemons to survive reboots, implements ID-based victim tracking, and introduces new C2 infrastructure. The embedded backdoor allows threat actors to execute commands remotely, log keystrokes, introduce additional payloads, or probe for lateral movement opportunities.

MILLIONS OF CARS EXPOSED TO REMOTE HACKING VIA PERFEKTBLUE ATTACK

PCA Cyber Security discovered critical vulnerabilities in OpenSynergy's BlueSDK Bluetooth framework affecting millions of cars from Mercedes-Benz, Skoda, and Volkswagen. The "PerfektBlue" attack enables remote code execution through Bluetooth pairing, allowing attackers to track vehicles, record audio, access phonebook data, and potentially control steering/wipers.

CRITICAL MCP-REMOTE VULNERABILITY ENABLES REMOTE CODE EXECUTION, IMPACTING 437,000+ DOWNLOADS

CVE-2025-6514, a critical vulnerability in mcp-remote (CVSS 9.6), allows arbitrary OS command execution when connecting to untrusted MCP servers. The flaw affects versions 0.0.5-0.1.15 and has been patched in 0.1.16. Other MCP vulnerabilities allowing for remote code execution and sandbox escapes were also discovered in the Inspector tool and Anthropic's Filesystem MCP Server.

HOW I DISCOVERED A LIBPNG VULNERABILITY 11 YEARS AFTER IT WAS PATCHED

While practicing secure code review, the author of this article decided to review the libpng C library. They found that libpng calculated memory allocations based on user-controlled values, such as “depth.” The author was able to trigger a crash using a custom PNG file, but then discovered that the bug was fixed 11 years ago when it was first reported.

TAKING SHELLTER: A COMMERCIAL EVASION FRAMEWORK ABUSED IN- THE- WILD

Elastic Security Labs found threat actors using an illicit version of SHELLTER, a red team evasion framework, since April to deploy infostealers like LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The malware uses advanced evasion techniques such as polymorphic code, API hooking bypasses, indirect syscalls, memory scan evasion, and AMSI bypass, resulting in low detection rates. Elastic issued a dynamic unpacker and YARA rules to help detect SHELLTER samples, which are spread via YouTube comments and phishing campaigns targeting content creators.

ABUSING CHROME REMOTE DESKTOP ON RED TEAM OPERATIONS: A PRACTICAL GUIDE

Red team operators can abuse Chrome Remote Desktop as a legitimate remote access tool by installing the MSI package with admin privileges and using an undocumented `--pin=111111` parameter to bypass GUI PIN setup requirements. The technique leverages Google's infrastructure and HTTPS/WebRTC protocols, making it more difficult to detect than traditional remote access tools, as it appears as legitimate Google traffic. Defenders should implement application allowlisting solutions, such as AppLocker, and monitor for "Chrome Remote Desktop Host" installations to prevent unauthorized remote access deployments.

Register now and discover how to safeguard every M&A stage.

THREAT DESIGNER

Threat Designer is an AI-driven agent designed to automate and streamline the threat modeling process for secure system design.

AIRMDR (PRODUCT LAUNCH)

AirMDR provides automated playbooks to investigate and respond to threats while constantly learning.

OPENCVE

OpenCVE is an open-source platform designed for efficient monitoring and management of CVEs. It consolidates vulnerability data from sources like MITRE, NVD, RedHat, and Vulnrichment, allowing users to filter, track, and organize based on various criteria such as vendor, product, and severity. Users can subscribe to product updates, receive alerts, analyze changes, and collaborate seamlessly through its user-friendly interface.

BROWSER EXTENSIONS TURN NEARLY 1M BROWSERS INTO WEBSITE-SCRAPING BOTS

Browser extensions that use the MellowTel-js library are being used to scrape websites using users' browsers. The library has close ties with Olostep, a company that bills itself as “the world's most reliable and cost-effective Web scraping API,” suggesting that Olostep is using its installed base of extension users to fulfill scraping requests. 245 extensions that implement this library have been discovered across Chrome, Firefox, and Edge, with a total of nearly 1M users.

JACK DORSEY SAYS HIS ‘SECURE' NEW BITCHAT APP HAS NOT BEEN TESTED FOR SECURITY

After launching his new security-focused, Bluetooth chat app, Bitchat, Jack Dorsey added a warning to its GitHub page that it has not received an external security review and should not be used in production. This disclaimer was prompted by a security researcher who discovered a vulnerability that allowed them to impersonate someone else by intercepting their “identity key” and “peer id pair.” Other security researchers have reported concerns over Dorsey's claims that Bitchat has forward secrecy, as well as reported a potential buffer overflow bug.

GMX HALTS TRADING, TOKEN MINTING FOLLOWING $40M EXPLOIT

The GMX protocol halted trading on GMX V1, the first version of the GMX perpetual exchange deployed on the Arbitrum network, after a liquidity pool suffered an exploit that resulted in $40 million in funds being stolen. The attacked pool is a liquidity provider for the GMX protocol with underlying assets that include Bitcoin, Ether, and stablecoins. Blockchain security company SlowMist attributed the exploit to a design flaw that allowed hackers to manipulate the GLP token price.

AMD WARNS OF NEW MELTDOWN, SPECTRE-LIKE BUGS AFFECTING CPUS

AMD has discovered Transient Scheduler Attack (TSA) vulnerabilities affecting EPYC, Ryzen, and other chips that could potentially enable information disclosure through side-channel attacks requiring local access.

SOUTH KOREAN GOVERNMENT IMPOSES PENALTIES ON SK TELECOM FOR BREACH

South Korea fined SK Telecom only $21,890 for a breach that exposed 27 million customer records, but imposed strict regulatory requirements, including quarterly security assessments, mandatory USIM replacements, and organizational changes that the company expects will cost $511 million in lost revenue.

FOUR ARRESTED IN CONNECTION WITH M&S AND CO-OP CYBER-ATTACKS

The National Crime Agency detained four teenagers aged 17-19 for launching cyberattacks involving ransomware and data theft against M&S, Co-op, and Harrods, with charges including computer misuse, blackmail, and organized crime.

OPENAI TO RELEASE WEB BROWSER IN CHALLENGE TO GOOGLE CHROME

OpenAI plans to launch an AI-powered web browser that integrates chat features and AI agents capable of completing user tasks like filling forms or booking reservations. The browser could give OpenAI access to key user data that fuels Google's advertising business, which accounts for nearly 75 percent of its revenue. Chrome holds more than two-thirds of the global browser market, while OpenAI's ChatGPT has 500 million weekly users and 3 million business subscribers. The browser is built on Google's Chromium code and is part of OpenAI's broader push to expand its services and compete more directly with Google.

INSIDE THE DISNEY-ITV DEAL: HOW CONTRASTING CORE AUDIENCES HAVE BOSSES “PLANNING FOR SUCCESS”

Disney and ITV will begin cross-promoting each other's streaming content on July 16 through curated sections called “Taste of ITVX” and “Taste of Disney+.” Disney+ users will get access to ITV titles like Love Island and Spy Among Friends, while ITVX users will see shows like The Bear and Andor. The deal is based on complementary audiences, with Disney+ skewing under 34 and ITVX skewing over 45. Disney expects the partnership to boost sign-ups and engagement, and plans to pursue similar arrangements with other European broadcasters.

HOW TO BUILD AN IRL EVENTS STRATEGY

In-person events can be powerful marketing tools, but only if they align with a startup's audience, go-to-market motion, and existing strengths. Events should be evaluated like any other marketing channel, using clear frameworks that consider fit, expected ROI, and whether the team has the right resources to execute well. Success depends on treating events as full campaigns, with strong creative, content, and follow-up. Coverage and composition are key to choosing the right events: high coverage brings reach, while high composition ensures relevance. Events fail when handled by the wrong people, are overly sales-driven, or lack brand alignment, so thoughtful planning and execution are critical.

SCALE AI: HOW A $14B BRAND BUMP IMPACTS ORGANIC SEARCH PERFORMANCE

Scale AI's growth in search visibility is closely tied to its exploding product and brand presence. Scale's brand strategy has positioned it as essential AI infrastructure, using high-profile partnerships and credibility signals to dominate organic and generative search. Meta's $14.3 billion investment in the company triggered a 140% increase in traffic and resulted in 93,000 backlinks. Its homepage now receives 80% of all organic traffic, while product pages reinforce trust and credibility to optimize for high-intent users. Scale also gained significant visibility in generative engines like ChatGPT and Perplexity, with ChatGPT alone accounting for 25% of its web referrals last month.

QUICK LLM-OPTIMIZATION EXERCISE

When asked how to optimize for LLM, a starting point is to see how your brand is currently represented by ChatGPT. Begin by prompting with “What is [your brand name]?” and review if the description matches your current offerings or if it's outdated. Check the sources ChatGPT uses, update or remove old content to align with your latest messaging. Then repeat the process with common prospect questions.

Read the Delve case study.

PROFOUND

Profound helps brands understand how AI impacts their online presence. It monitors brand mentions, citations, and search volume, showing how AI platforms present a brand. Features include dashboards for AI crawl activity, share-of-voice insights, and competitive analysis. Brands can discover top questions, create content briefs, and optimize answers to increase AI visibility.

WHAT PEOPLE ARE VIBE CODING

This piece features over 50 examples of tools built by non-technical people. Projects include apartment delivery buzzers, meal planners, parenting apps, Chrome extensions, and productivity tools. Many began by describing their ideas in plain language and refining them through iteration. Popular platforms include Cursor, Claude Code, Replit, and Lovable, along with v0, Bolt, and ChatGPT. While most tools solve personal needs, many also end up benefiting others. Chrome extensions are especially common, and women are well represented in this growing space.

EXACTLY WHAT TO MEASURE WITH LIFT-BASED MARKETING INVESTMENTS

Traditional attribution models are no longer reliable due to privacy laws, ad blockers, and fragmented customer journeys. A better way to measure results is through lift-based testing. This approach tracks the increase in conversions or engagement after a specific tactic begins. It compares results against a baseline to show real impact. The process starts with measuring exposure, such as impressions. It then looks at engagement, like replies or subscriptions, followed by conversions or sales. Testing different tactics over time reveals what actually works.

HOW ALAMO DRAFTHOUSE MADE GOING TO THE MOVIES COOL AGAIN

Alamo Drafthouse redefined the movie theater experience by treating film as a cultural event rather than passive entertainment. It earned national acclaim through unique programming like live-scored silent films, curated pre-shows, and interactive comedy events. By 2012, it ran Austin's three highest-volume restaurants and reported over $12 profit per person, far exceeding traditional theaters. Its acquisition by Sony in 2024 confirmed its lasting influence, as it continues to thrive by building local communities around film rather than copying industry trends.

TIKTOK REFUTES REPORTS THAT IT'S DEVELOPING A SEPARATE US VERSION OF THE APP

TikTok has officially denied reports that it's building a U.S.-only version of its app, as part of its efforts to remain in America following the forced sell-off of the platform.

4 MUST KNOW AI PROMPTS

Prompts for competitive analysis, account based marketing, and newsletter links.

STATIC ADS THAT SELL

3 static ad examples that focus on consumer psychology to drive conversions.

Try the playground & learn more about Managed Sync

MONETIZATION ISN'T JUST PRICING

Stakeholders increasingly expect product managers to clearly link new features directly to revenue growth, rather than relying solely on high-level business cases. To confidently address monetization questions, PMs should clearly define target customers, pricing strategies, value assumptions, validation methods, and tradeoffs involved.

WHAT CAN AGENTS ACTUALLY DO?

AI agents use LLMs plus tools to evaluate context, suggest actions, control flow, and operate as software programs. They can greatly improve systems like support or bug triage, but only if the underlying software and design are strong - otherwise, agents just magnify existing issues.

EMPOWERED FOR DELIVERY, BUT…

Tech companies balance team autonomy with managerial oversight, rewarding initiative and boundary-crossing for productivity, but restricting open dissent to controlled, often ineffective channels. True empowerment requires deeper organizational trust and safety, which many companies superficially promise but rarely provide.

WHY YOUR POWER USERS ARE YOUR BIGGEST PRODUCT RISK

Product managers face the "power user paradox," where enthusiastic users push niche features that distract from broader product goals. Successful teams engage power users strategically without losing sight of mainstream needs.

Download the guide from Persona

SEEING THE SYSTEM: HOW TO NAME WHAT'S REALLY HOLDING YOU BACK

Companies often mistake cross-functional strategy problems for departmental failures. Effective leaders proactively address interconnected challenges, foster open communication, clearly define strategic trade-offs, and decisively tackle underlying systemic issues.

HERE IS HOW I APPROACH STARTING A NEW JOB

Succeeding in a new role means balancing fast wins with smart learning. Focus on what works, make quick improvements, test bold ideas, and shape strategy early, adjusting if you're in an interim role.

HOW TO LEVEL UP YOUR CONFIDENCE GAME?

Confidence grows by strategically presenting evidence, clearly defining meeting objectives, tactfully redirecting discussions, and taking action despite initial uncertainty.

HOW TO TALK ABOUT YOUR COMPETITION

In competitive markets, success comes from embracing competition as validation, differentiating clearly without negativity, and strategically focusing rather than reacting impulsively.

TO BUILD TRUST IN COMPLEXITY, OFFER SMALL CHOICES AND FAST FEEDBACK

Simplicity and predictability give users a sense of control.

HOW VIBE CODING SHARPENS PM SKILLS

Using AI-driven coding tools inadvertently sharpens product management skills by forcing clear positioning, precise communication, ruthless prioritization, iterative planning, and cost-awareness.