Search the archive

key? Centralizing credential management with 1Password.

You'll learn:

WATCH NOW

CRITICAL FLAWS FOUND IN AI DEVELOPMENT TOOLS DUBBED AN 'IDESASTER' — DATA THEFT AND REMOTE CODE EXECUTION POSSIBLE

A six-month investigation uncovered over 30 vulnerabilities across every major AI-integrated IDE tested, including GitHub Copilot, Cursor, Claude Code, and JetBrains products, resulting in at least 24 assigned CVEs. The attack chain exploits prompt injection via rule files, READMEs, or malicious MCP servers to hijack AI agents, which then abuse legitimate IDE features like JSON schema fetching or executable path configuration to exfiltrate data or achieve RCE. Organizations using AI coding assistants should audit workspace configurations, restrict AI agent permissions, and monitor for suspicious outbound requests from development environments.

POPULAR AI IMAGE GENERATOR EXPOSED OVER 1M IMAGES INCLUDING DEEPFAKES AND NUDITY FACE SWAPS

Security researcher Jeremiah Fowler uncovered an unsecured, publicly accessible database containing images and videos that appeared to belong to a company named SocialBook. The database included pornographic face swaps, deepfakes, and unaltered reference photos. It is unclear how long the images were accessible or whether the exposure was caused directly by SocialBook or through a third party.

PETCO CONFIRMS SECURITY LAPSE EXPOSED CUSTOMERS' PERSONAL DATA

Petco reports that a misconfigured software application briefly left certain customer files accessible online, exposing unspecified personal data before the issue was fixed. Details on the number of victims and exact data types remain undisclosed, though legal thresholds suggest that at least hundreds of customers were impacted.

HARDENING BROWSER SECURITY WITH ZERO-TRUST CONTROLS

This framework outlines six principles for browser-centric zero trust architecture: identity-first access control using federated IdPs, least-privileged access with time-bounded entitlements, continuous verification with adaptive policies, phishing-resistant FIDO2/WebAuthn authentication, device health gating via MDM/EDR integration, and remote browser isolation for high-risk sessions. Implementation follows CISA's Zero Trust Maturity Model through three stages—starting with SSO and passkey MFA, advancing to device compliance enforcement with SCIM automation, and achieving optimal state with per-request access decisions and automated RBI for privileged operations. Security teams should prioritize deploying passkeys to administrators first, integrate IdP conditional access with SIEM/SOAR to automate session revocation, and codify all ZTNA policies as infrastructure-as-code for governance.

NEW PROMPT INJECTION ATTACK VECTORS THROUGH MCP SAMPLING

Unit 42 researchers demonstrated three attack vectors exploiting the Model Context Protocol (MCP) sampling feature in AI coding copilots: resource theft through hidden prompts that consume token quotas invisibly, conversation hijacking via persistent prompt injection that alters LLM behavior across sessions, and covert tool invocation enabling unauthorized file system operations without user awareness. The attacks exploit MCP's implicit trust model, where malicious servers can craft prompts requesting LLM completions, with responses processed and hidden from users by the client's summarization layer. Organizations should implement request sanitization with strict templates, enforce capability declarations limiting server permissions, require explicit user approval for tool executions, and deploy statistical analysis to flag abnormal token usage patterns.

TANGLECRYPT: A SOPHISTICATED BUT BUGGY MALWARE PACKER

TangleCrypt is a previously undocumented Windows malware packer that features complex features such as the ability to execute in its own process or a child process based on a user-supplied string. The packer employs several common anti-analysis techniques such as anti-debugging, string encryption, dynamic import resolving, and unoptimized code. There are several bugs in the packer, which suggests that it may still be a work in progress.

EVILMIST

EvilMist's Enumerate-EntraUsers is an Azure Entra ID reconnaissance tool featuring 15+ user enumeration methods designed to work even when direct /users API access is blocked. It assesses MFA gaps, conditional access policy weaknesses, and privilege escalation paths with BloodHound-compatible export. Available in PowerShell and Python with stealth mode (configurable delays/jitter) for detection evasion.

TEXT GIBBERIFIER (WEBAPP)

A WebApp that inserts invisible Unicode characters into text to block AIs from reading it while preserving meaning for humans.

HELMET SECURITY (PRODUCT LAUNCH)

Helmet Security provides an end-to-end security platform for agentic AI, focused on securing Model Context Protocol (MCP) servers and connections between AI agents, software, and data. It discovers MCP endpoints, monitors and logs traffic, and blocks noncompliant or risky AI communication paths.

SANCTIONED SPYWARE MAKER INTELLEXA HAD DIRECT ACCESS TO GOVERNMENT ESPIONAGE VICTIMS

Researchers from Amnesty International and a coalition of newspapers released a series of reports based on data from Intellexa, a company selling spyware to governments and other clients. The leaked data included training videos showing that Intellexa employees could remotely access some of their customers through TeamViewer. Intellexa denies any misconduct, asserting that it only uses TeamViewer with client permission and supervision for technical support when issues need fixing.

WHY SECURITY NEEDS TO BECOME AN INTEGRAL PART OF AI DEVELOPMENT

Given the non-deterministic nature of LLMs, security teams need to embed themselves in the development of agentic and other AI tools. They should collaborate with developers and share tooling for code analysis and agent monitoring. Security teams should also use AI-based tools and social engineering to pentest models.

CLOUDFLARE FIREWALL REACTS BADLY TO REACT EXPLOIT MITIGATION

Cloudflare briefly knocked many customer sites and services offline after a flawed Web Application Firewall update meant to block a new remote code execution vulnerability in React Server Components. The misconfiguration took Cloudflare's network down for several minutes, disrupting platforms from e-commerce to cloud services and echoing earlier large outages at Cloudflare and AWS.

watching now

BIPARTISAN HEALTH CARE CYBERSECURITY LEGISLATION RETURNS TO ADDRESS A CORNUCOPIA OF ISSUES

A bipartisan group of senators reintroduced the Health Care Cybersecurity and Resiliency Act, which would mandate updates to HIPAA regulations, authorize a five-year grant program for health care entities, and improve HHS-CISA coordination on incident response and training.

HAVE YOU BEEN TARGETED BY STATE-SPONSORED HACKERS? APPLE, GOOGLE ISSUE FRESH ALERTS

Apple and Google issued threat notifications to users in over 150 countries, with Google specifically warning that several hundred accounts were targeted by US-sanctioned Intellexa spyware, exploiting zero-day vulnerabilities in mobile browsers.

SMS PHISHERS PIVOT TO POINTS, TAXES, FAKE RETAILERS

China-based SMS phishing crews are sending iMessage and RCS texts about rewards points, tax refunds, and fake retailers to steal victims' card data and one-time codes.

campaign workflows with Asana.

Try Asana for free →

WARNER BROS DISASTER? NETFLIX INKS DEAL FOR TROUBLED HOLLYWOOD GIANT

Netflix will likely consolidate streaming inventory across HBO Max and its own ad-supported tier, expanding its footprint in premium ad formats. This move will create a new scaled challenger to Disney and Amazon for high-value video ad budgets. It also raises the bar for branded content partnerships, audience targeting, and global reach in connected TV.

WORKING FROM HOME IS HARMING YOUNG EMPLOYEES

Remote work can hinder younger employees' career growth by limiting training, mentorship, and advancement opportunities. Many report missing informal learning and struggling to build visibility with managers. In-person proximity improves skill development, while remote work slows career progress and increases unemployment among recent graduates. As a result, younger workers are spending more time in offices.

3-STEP FRAMEWORK FOR ACCOUNT-FOCUSED WEBINARS

Focus webinars on a small set of target accounts and build the session specifically for them. Drive attendance with a structured sequence by calling top accounts 3 weeks out, involving a customer co-presenter 2 weeks out, sending the deck 1 week out, and texting key registrants the day before. Use a concise 30-minute format that shares learning, customer results, implementation, and Q&A. Then follow up within 2 hours with recordings, templates, and personalized sessions for target accounts.

WINNING BACK CUSTOMERS REQUIRES FIXING WHAT DROVE THEM AWAY

Winning back customers or employees is more effective than acquiring new ones. However, it requires admitting mistakes and proving real change. People leave when gaps form between expectations and experience. Most win-back attempts fail because they rely on generic messages, discounts, or incentives without addressing the root cause. Effective win-backs start by diagnosing why someone left, fixing the issue, owning the mistake, and showing concrete proof of improvement. Outreach should be personalized, returning must feel like an upgrade, rejoining should be easy, and reinforcement after the return is essential.

Try Asana for free →

GEMINI TIP: SELECT MULTIPLE CHROME TABS TO QUERY

OPENAI SAYS IT'S TURNED OFF APP SUGGESTIONS THAT LOOK LIKE ADS

OpenAI paused app suggestions in ChatGPT after users reported that they appeared as ads. These were unpaid recommendations for platform apps, but the execution created confusion. Future brand placements in AI tools will require clear separation from promotional content and stronger user controls.

PRODUCT MARKETING PRIORITIZATION: A FIELD GUIDE FOR DOING LESS, BUT BETTER

Most PMM teams struggle to prioritize because they lack a clear strategy. A solid strategy stays simple, actionable, and flexible. This guide shows PMMs how to set goals, define their role, cut low-value work, and use an Action and Priority Matrix to rank tasks by impact and effort so they focus on quick wins.

MARKETING MISTAKES MADE BY GOOGLE+

Google+ failed because millions of sign-ups did not turn into real use, and 90% of sessions lasted less than 5 seconds. The platform never built emotional pull or a clear identity, and users spent only about 3 minutes/month on it despite more than 200M registered accounts. Over-integration into products like YouTube and Gmail caused friction instead of adoption, and two data leaks that exposed millions of profiles damaged trust. Without creator activity or a core action that kept users returning, the platform could not build habits and ultimately shut down.

NEW RESEARCH: WHAT WE LEARNED FROM ANALYZING 60K+ GOOGLE FAN-OUT QUERIES

Google uses an average of 9.06 fan-out queries per prompt, and 59% of prompts trigger between 5 and 11 queries. Software prompts generate the most fan-outs at 11.7, while Local prompts generate the fewest at 3.79. Fan-out queries average 6.7 words, and 77% fall in the 5 to 8 word range. The most common Ngrams include 2024 or 2025 at 6.26% and reviews at 2.14%, which shows that fresh content, comparison content, and review content are major drivers of what Google chooses to surface.

WHAT ARE MID-MARKET SAAS MARKETING LEADERS PRIORITIZING?

Leaders are focused on pipeline quality, adjusting to AI search, and brand strength.

CANVA'S UNIQUE CANCELLATION FLOW

When users cancel, Canva shows the premium features they used most and how many times they used each one.

WHY YOUR MARKETING ISN'T WORKING

A consistent theme is misalignment between content and distribution.

More doors opening soon! Bookmark this page to follow along

NETFLIX WINS THE WARNER BROS. DISCOVERY BIDDING WAR, ENTERS EXCLUSIVE DEAL TALKS

Warner Bros. Discovery (WBD) is moving forward with exclusive deal talks with Netflix. Netflix offered WBD $30 a share for the studio and streaming assets. The deal includes a $5 billion break-up fee. Netflix obtaining WBD's assets could dramatically reshape the entertainment landscape and give Netflix even more power over Hollywood.

META'S ZUCKERBERG PLANS DEEP CUTS FOR METAVERSE EFFORTS

Meta is expected to meaningfully cut resources to the metaverse project, an effort once framed as the future of the company. Executives are considering potential budget cuts as high as 30% for the metaverse group next year. This will likely include layoffs. The savings are expected to funnel towards other projects within Meta's Reality Labs division.

MASAYOSHI SON HAMMERS OUT HIGH-TECH FACTORIES PLAN WITH WHITE HOUSE

SoftBank Group is hammering out the details of a plan that could see CEO Masayoshi Son marshaling hundreds of billions of dollars to build Trump-branded industrial parks around the US. The facilities will be largely built on federal lands using funds pledged by the Japanese government as part of a recent trade deal. They will produce components for artificial-intelligence infrastructure. The funds could be flowing as soon as early 2026.

A FENTANYL VACCINE IS ABOUT TO GET ITS FIRST MAJOR TEST

ARMR Sciences is launching a trial to test its fentanyl vaccine in people for the first time. The vaccine is designed to be given to people before they use the drug. It neutralizes fentanyl in the bloodstream before it reaches the brain, preventing the respiratory failure that comes with overdose, as well as the euphoric high people get when taking the drug. ARMR is testing an injectable vaccine in the upcoming trial, but it is also looking into an oral formulation similar to a Listerine strip for future trials.

Download the guide.

WHY I IGNORE THE SPOTLIGHT AS A STAFF ENGINEER

You don't have to chase the spotlight to have a meaningful, high-impact career at a big company. The tech industry loves to tell you to move fast, but there is a path where leverage comes from depth, patience, and the quiet satisfaction of building the foundation others stand on. It's okay to stay put, dig in, and build something that lasts. Some projects require engineers to sit with a problem space for years until they understand it well enough.

TANSTACK AI

TanStack AI is a type-safe, framework-agnostic AI SDK with a unified interface across multiple providers. It enables engineers to build adaptive, intelligent apps with streaming, tool calling, agents, and multi-provider support. It supports multimodal content, chat completion, headless chat state management, and more. TanStack AI is a complete AI ecosystem and not a vendor platform - there are no middlemen or service fees, and no vendor lock-in.

TESLA CEO ELON MUSK ANNOUNCES MAJOR UPDATE WITH TEXTING AND DRIVING ON FSD

Tesla says it will allow people to text and drive while using Full-Self Driving (FSD) within the next couple of months. There are some concerns with the capability, as laws in the US specifically prohibit texting and driving. Some states prohibit drivers from even holding a phone when the car is in motion. Elon Musk has noted that the capability will only be available depending on the context of surrounding traffic, but did not provide any details about what conditions FSD would allow a driver to text and drive.

SOCIAL SIGNALS 2025 (2 HOUR READ)

A lot has changed since last year, both online and offline. This presentation tries to make sense of all of it. It contains screenshots and news articles collected throughout the year that tell the story of what's been happening.

for instrumenting real-world apps. Get your free copy