Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Apple has backported a fix for CVE-2024-23296, which was disclosed in March, to older devices. The vulnerability was a memory corruption bug that allowed attackers to bypass kernel memory protections. Apple reported that the vulnerability may have been actively exploited.
The Ebury botnet has compromised 400K servers over the past 15 years. Recent attacks show that operators have been targeting hosting providers to perform supply-chain attacks on clients renting virtual servers. The Ebury operators are financially motivated and often deploy credential stealers onto compromised servers.
Christie's auctions worth $840m have been disrupted by a cyber attack, affecting the sale of valuable items like a Van Gogh painting and rare wine. The website is offline, but bids can still be placed over the phone or in person. An alternative website with basic information is available. Auctions continue and there are plans for upcoming sales.
AhnLab Security Intelligence Center has identified a North Korean campaign targeting South Koreans with a malicious LNK file. The file distributes a loader for the RokRAT C2 malware. This article provides a deep dive into the loader and IoCs for the campaign.
Tycoon 2FA is a phishing-as-a-service platform that was recently updated to enhance detection avoidance. The toolkit relies on victims entering their information into attacker-controlled infrastructure. After MFA prompting, session cookies are relayed to the attacker. This article provides some real-world examples and defenses.
This blog post describes the DNS Tunneling attack technique, which is a method for attackers to hide and transport data through DNS traffic. Malicious actors can use DNS tunneling to track user activities and communicate with compromised hosts. Organizations can detect and mitigate DNS tunneling campaigns effectively by analyzing indicators like domains and IP addresses.
Keylime provides an end-to-end solution for bootstrapping hardware rooted cryptographic trust for remote machines, the provisioning of encrypted payloads, and runtime system integrity monitoring.
SharpGraphView is a post-exploitation toolkit that provides modular access to the Microsoft Graph API for cloud security teams.
Trail of Bits discusses how it has worked to add cryptographically verifiable build provenance for all bottles. This feature ensures that each bottle's content is bound to specific build-time metadata, reducing the risk of compromised or malicious installations. While still in early beta, users can verify attestations using the "brew verify" command, but caution is advised until further development is completed.
This blog post discusses techniques used in the XZ backdoor, focusing on locating function addresses, symbol tables, and system information within ELF files. It also explains the process of function hooking and demonstrates a simplified version of the XZ backdoor's logic using library functions and memory address manipulation. The XZ backdoor's method involves finding specific addresses and performing actions based on that information, simulating the process of locating critical functions within programs.
The Black Basta ransomware group is attacking critical infrastructure, affecting over 500 organizations in the past two years, including a healthcare system with 140 hospitals. FBI and security researchers warn that the group is causing severe disruptions and targeting healthcare organizations through novel social engineering tactics.
MITRE has launched EMB3D, a threat-modeling framework for embedded devices in critical infrastructure. EMB3D aims to help device vendors understand and mitigate cyber threats targeting embedded devices. The framework focuses on providing security mechanisms early in the design cycle to create inherently secure devices.
Apple and Google on Monday officially announced the rollout of a new feature that notifies users across both iOS and Android if a Bluetooth tracking device is being used to stealthily keep tabs on them without their knowledge or consent.
Zscaler investigated a recent hacking incident and confirmed that only a test server was compromised, with no impact on customer data.
CISA, DHS, FBI, and international partners have published a guide to help civil society organizations reduce cyber threat risks by protecting high-risk communities.
Adobe Analytics data reveals that U.S. e-commerce spending reached $331.6 billion in the first 4 months of 2024, up 7% YoY. Consumers are increasingly opting for cheaper goods across various categories, influenced by persistent inflation. Buy Now Pay Later services are expected to drive up to $84.8 billion this year. Mobile shopping continues to dominate, with mobile revenue expected to surpass desktop during the upcoming holiday season. Paid search remains the biggest driver of sales for retailers.
The advertising industry tells consumers to ‘buy, buy, buy', yet overconsumption is one of the driving forces of climate change, energy shortages, and poor mental health. Brands can employ honest and clever ads to promote their products without encouraging consumers to buy irresponsibly. This article contains examples from IKEA and Volkswagen that use honest advertising to effectively promote a product.
This post outlines a framework for rewriting a cold email targeting cloud cost optimization. Avoid 'salesy' subject lines, reduce personal pronouns, and emphasize the impact of the problem on the prospect. The revised email focuses on providing valuable insights, incorporating social proof, and adopting a softer tone to encourage response from recipients.
Sponsored
Advertising on Brave [9] is your cure for skyrocketing CPMs and diminishing performance. Reach and convert new customers through privacy-forward, premium advertising. You can start with as little as $500 [9], and there's a 50% discount if you pay with Brave's Basic
The CMO at Jellyfish shares a 40-slide deck with 10 tips for marketing leaders. These include owning a top, bottom, and middle number, understanding efficiency of GTM channels, and using agencies as supplemental support when scaling.
Snapchat has announced a new initiative to help advertisers understand the carbon footprint of their Snap ads. It's based on elements like server load to create and host ads, usage of mobile devices to view them, and percentage of overall company emissions.
While advances in marketing analytics and technology have been made, a significant portion of businesses still face difficulties in calculating ROI. Typical marketing KPIs do not translate directly to revenue and ROI metrics, which can prevent buy-in from other leaders. Brand marketing in particular is typically lacking metrics that matter to the C-suite. To counteract this, marketing leaders should manage activities that drive the KPIs that ultimately drive business results, while also presenting marketing results with concrete financial KPIs.
Sponsored streams have become a popular marketing strategy for video game companies seeking to tap into the vast audience on platforms like Twitch. However, these investments may not always yield positive results. While organic streams have a modest impact on game usership, sponsored streams often fail to generate significant traction, leading to substantial losses in ROI. The only exceptions are some lesser-known games or titles highly rated by critics.
Rubrik, a cybersecurity SaaS company, has grown since 2014 to a post-IPO valuation of $6.6 billion. Organic is a major part of Rubrik's marketing mix, with over 25% of site traffic coming from SEO. 23% of the SEO traffic and 39% of the top keywords are coming from its ‘insights' content hub, which houses 70+ educational assets related to its industry. These pages rank well in part because of high E-E-A-T, keyword frequency, and internal linking.
58% of companies are cutting back on sustainability-related marketing over the worry of being called out for greenwashing.
Bumble faced criticism for a billboard ad devaluing celibacy, prompting the company to apologize and remove the ads.
Rather than focusing all your energy on selling to strangers, talk about “why them” instead of “why you”.
This author successfully replaced OpenAI's API with an open-source alternative to reduce the cost of running large-scale AI applications. They tried using Ollama on a local machine to generate text summaries, but limitations with concurrent processing led to them using vLLM (a fast inference runner). To handle large volumes of requests, the author used a Kubernetes cluster to deploy and load balance vLLM.
Caches need to be maintained and updated. The process of cache invalidation can be challenging due to factors like thundering herds (a sudden surge of requests) and cache inconsistency (different parts of the data updating at different times). To handle cache invalidation properly, it's important to prioritize using a robust invalidation protocol and manage data dependencies.
The Asynchronous State Handler pattern improves UX in web apps by decoupling data fetching from the UI. It wraps asynchronous queries with meta-queries that track the status (loading, success, error) of the data fetching process. This allows the UI to react dynamically to these states, displaying loading indicators or error messages when needed. The pattern can be implemented in React using a custom hook.
Over a 12-year career at Google, Addy Osmani learned to put users first, collaborate well by actively sharing knowledge, and embrace lifelong learning. He encourages readers to just get started and iterate rather than trying to strive for perfection.
Communicating in clear deltas (i.e., quantifying before and after states) is a great way to get your point across effectively. For example, in performance reviews, rather than vague statements like "improved performance," specify the percentage reduction in page load time and its impact on key metrics like user engagement. Convincing others to adopt your ideas is easier when you quantify the current problem and the expected improvement from your proposed solution.
Google introduced upgraded versions of its Gemini AI model, including a public preview of Gemini 1.5 Pro with a 2 million token context window at I/O 2024. For Android developers, the company highlighted Gemini Nano, an on-device AI model for faster local processing. Flutter and Dart also received updates, with Flutter now supporting compilation to WebAssembly and Dart introducing the initial stages of macros.
Gemini Flash is a new lightweight model from Google that features multimodal reasoning and a long context window of up to one million tokens.
Socket Security protects applications from hidden malware in open source code. It goes beyond traditional scanners to find new threats and integrates with GitHub for developer fixes.
Google is integrating Gemini into various products, enhancing Search with AI Overviews and introducing Ask Photos in Google Photos for intelligent image searches. It has showcased AI agents that can perform complex tasks like shopping returns or helping users relocate.
Most generative AI projects fail to reach production or deliver significant revenue. Successful GenAI projects prioritize understanding business problems before selecting tools, recognize GenAI is part of a larger tech stack, keep humans involved to guide AI, and rely on trustworthy, traceable data for the best results.
Google revealed several new tools and features for web developers at I/O 2024 specifically related to Google Gemini, Web Assembly, and WebGPU, along with enhancements to Chrome DevTools, Angular, and Google Maps.
Veo is a new video generation AI model from Google Deepmind that can generate 1080p resolution videos that can go beyond a minute long.
URLhaus is a database of malicious URLs that are being used for malware distribution.
Needle in a Needlestack (NIAN) is a new benchmark that was created to test how well LLMs process information in their context window - GPT-4o has significantly outperformed other models in this test.
→ Zero Flakes guaranteed
Sponsored
Bugs sneak out when less than 80% of user flows are tested before shipping. But getting that kind of coverage — and staying there — is hard and pricey for any sized team.
OpenAI announced a new AI model yesterday called GPT-4o that can converse using speech in real time, read emotional cues, and respond to visual input. It will roll out over the next few weeks for free to ChatGPT users and as a service through API. Paid subscribers will have five times the rate limits of free users. The API will feature twice the speed, 50% lower cost, and five times higher rate limits compared to GPT-4 Turbo. A 26-minute long video that introduces GPT-4o and demonstrates its abilities is available in the article.
Meta is reportedly working on AI-powered earphones equipped with cameras. Internally codenamed 'Camerabuds', the earphones will leverage AI capabilities for real-time object identification and foreign language translation. Meta's leadership sees AI-powered earphones as the next logical step in the evolution of wearable technology. It has partnered with Kansas-based electronics company Ear Micro to explore the possibilities of this emerging technology.
Unitree has released the first few details on its G1 Humanoid Agent, a $16,000 robotic helper. The robot is equipped with 3D LiDAR sensors, a depth camera, three-fingered grippers, and a 9,000-mAh battery pack. It can recover from brutal kicks and punches, as seen in the short demo video in the article. At around 35 kg, the robot can fold itself down to 690x450x300-mm proportions for compact carry.
Scientists often label cells with proteins that glow to measure changes in gene expression, but this technique is difficult to apply to structures deep within the brain as light scatters too much before it can be detected. MIT engineers have engineered blood vessels to express a protein that causes them to dilate in the presence of light. This dilation can be observed with magnetic resonance imaging, allowing researchers to pinpoint the source of light. The new technique allows researchers to explore the inner workings of the brain in more detail than previously possible.