Many MCP environments rely upon long-lived credentials such as API keys, but they store them incorrectly in world-readable files or get leaked via chat logs. The community-provided MCP server for Figma even stores its credentials in a world-readable and world-writeable file that attackers can use for session fixation attacks. OAuth should be implemented in MCP servers for apps that support it, and other MCP servers should consider using OS native credentials stores such as macOS Keychain and Windows' Credentials Storage API.
Drata delivers the world's most advanced Trust Management platform – making risk and compliance accessible, continuous, and 10x more automated than ever before.
CloudSEK scours the surface, dark, and deep web to identify cyber risks, data leaks, identity theft, and other threats and helps organizations assess their cybersecurity posture from the attacker's perspective.
GhostLine is an AI-powered vishing operative. When a user feeds it a phone number, GhostLine uses a cloned voice to build rapport, gather intel, and extract credentials.
Research reveals AI-powered crypto trading bots can be manipulated through prompt injection attacks on ElizaOS, an open-source framework. Attackers can plant false memories in the bot's database, causing it to redirect payments to their wallets.
Researchers discovered dangerous default IAM roles in AWS services that grant excessive permissions like full S3 access. These roles enable attackers to escalate privileges and move laterally across services, potentially compromising entire AWS accounts. AWS has modified the AmazonS3FullAccess policy in response.
KrebsOnSecurity was hit by a huge 6.3 Tbps DDoS attack, likely as a test by a new botnet called Aisuru. The botnet uses hacked Internet of Things (IoT) devices and is linked to a person known as "Forky" who sells DDoS services online. Experts say releasing the botnet's code might weaken its power by creating more, smaller botnets.
A 19-year-old student was convicted of hacking PowerSchool, stealing data on millions, and extorting a ransom while threatening to leak the information.
The LockBit ransomware gang operates like a business by using affiliates for attacks, but most victims don't pay ransoms, and affiliates often fail to achieve results despite employing threats and pressure.
Instagram has launched a 6-week, invite-only referral program offering select US-based creators up to $20K for driving new users or traffic to the platform via links shared outside the app. Participants can earn $100 per eligible sign-up or per 1K eligible visits. The initiative encourages creators to promote Instagram on rival platforms like TikTok, YouTube, and Substack. As part of Meta's broader push to retain creator loyalty amid increasing competition, this test follows previous incentives like the “Breakthrough Bonus” and exclusive content deals.
Only 12% of creative directors in the UK are women, and the number is even lower when factoring in class and ethnicity. Systemic barriers, from rigid workplace norms to caregiving responsibilities and biased leadership expectations, make it difficult for women to enter and advance in creative leadership. Flexible work environments like Born Social have shown that inclusion strengthens teams and leads to more effective, emotionally intelligent campaigns. Companies with diverse leadership are 25% more likely to outperform peers, yet many women still face personal, financial, and cultural hurdles that limit access and retention. Real change requires equity-focused policies, mentorship, and a redefinition of what leadership looks like.
RevenueCat tested in-app purchases against web purchases after Apple allowed developers to bypass the App Store fee. In a four-way experiment with 5.6K new U.S. users of Dipsea, a subscription-based audio storytelling app for intimacy and wellness, the in-app only variant saw a 42% higher initial conversion and trial start rate than the web-only version, even with a 30% web discount. Most drop-off happened at the payment step, showing that sending users out of the app significantly reduces conversions. While web payments may offer longer-term advantages like faster payouts, early data suggests they come with a steep short-term cost.
Firms that created more distinct content from their competitors on X saw better results in engagement and audience expansion. A study categorized brand activity into three tiers, starting with basic promotional updates, followed by community-focused content, and finally, co-creation strategies that invited user input. Only a minority of brands operated in the last and most distinct tier, but those that did captured much more attention and loyalty.
Personal LinkedIn accounts reach 10X more people than company pages. To encourage your team to post, run a friendly internal competition with rewards. Track metrics like follower growth, engagement, impressions, and reach. Let the team vote on who created the best content. Set a shared goal for leads, meetings, or revenue, and make rewards conditional on the team hitting that goal to keep everyone accountable.
This free webinar on May 27, hosted by Exit Five in partnership with Loom, will explore how marketing leaders can reduce meeting overload and improve communication. Ashley Faus and Dr. Molly Sands from Atlassian will be sharing tips on running better meetings, using async tools like Loom, making work more visible, and balancing strategy with hands-on execution.
Adobe will automatically migrate Creative Cloud All Apps subscribers to a higher-priced Creative Cloud Pro plan on June 17, raising monthly rates. The new tier includes expanded generative AI capabilities such as Firefly-powered image and video tools, unlimited AI features in core apps, and 4,000 monthly generative credits. A lower-priced Creative Cloud Standard plan is available, but it restricts access to premium AI tools and mobile apps.
The last 16 years have seen a disconnect between growing media investment and stagnant brand growth across industries, from retail to pharmaceuticals. Advertisers shifted resources to digital platforms that optimize for short-term engagement and metrics, but this transition has failed to replace the long-term equity built by traditional brand campaigns. The result is a growing perception in the C-suite that marketing's primary role is cost containment rather than strategic, but intangible value creation.
Poppi's Alpine Blast campaign used gaming to drive customer interaction, launching a Fortnite mini-game with Creator Corp and a nostalgic arcade-style web game that reached 126,000 plays in four days. The brand supported this effort with a limited-edition merch drop and a Coachella-adjacent event featuring influencers and fans, reinforcing its strategy of blending digital experiences with real-world cultural trends.
Strategies include analyzing your competitors' frustrated customers, explaining your product to a child, and tracking the online behavior of 3 customers each week.
Duolingo has wiped its social channels weeks after the company's AI-first announcement triggered user backlash and anti-AI sentiment across its comment sections.
Bolt, Lovable, and v0 let anyone vibe-code prototypes in minutes, but those apps don't scale securely to production. Without guardrails, outputs are inconsistent, non-compliant, and unsustainable.
A three-layer architecture can solve common data fetching problems in React apps. Layer 1 uses Server Components for initial data loading, Layer 2 uses React Query for client-side caching and updates, and Layer 3 uses optimistic updates for instant UI feedback. This separation of concerns prevents the typical issues that come from naive approaches (like scattered useEffect hooks), keeping components clean and focused on rendering.
React Server Components (RSC) promise server-side rendering without client-side JavaScript for cleaner code and better performance. However, they don't always work well with infinite scrolling implementations. Instead, React Query still might be needed for client-side data management.
A simple search engine can be built using word embeddings, representing words as vectors in a multi-dimensional space to capture their meaning. The search engine embeds blog posts and queries, then ranks posts based on cosine similarity to the query embedding, with cosine similarity measuring the angle between the vectors. To avoid downloading a large word2vec file, the implementation shown in the post splits the data into smaller files and uses HTTP Range requests for selective data retrieval.
Production tests are automated tests running in the production environment to make system reliability better. These tests, executed frequently, offer immediate failure notifications, acting as early warnings before customer impact. They also serve as integration tests, validating deployments and detecting mismatches with other services.
The value of software solutions is primarily in the team, business logic, and design, not the code itself. This developer had an experiment where he recreated a complex web portal in two weeks, a project that originally took a team six months. This was possible because he retained the needed knowledge and experience from the previous project.
Software engineering is often viewed as straightforward, but its magic lies in the bidirectional relationship between vision and engineering, where understanding informs creation. Abstraction layers in software development can prevent the deep understanding needed for truly creative outcomes. This principle extends to engineering organizations, where siloed, autonomous teams can struggle with positive change.
Scrape public web data at scale with perfect success. Crawlbase handles rotating IPs, JavaScript rendering, and CAPTCHA solving so you only have to call an API [11]. With 30+ geolocations, millions of IPs, and free first 10,000 requests, you're covered on scale, speed, and
Google has launched Google AI Ultra, a premium subscription service that offers the highest access and usage limits to its most advanced AI models and features like Gemini, Flow, and extensive storage. It costs $250 a month.
Motion+ Cursor is a React and Vue component that has been updated with magnetic cursor and cursor zone features. Magnetic cursors allow the cursor to snap to or pull towards elements, while cursor zones enable dynamic cursor changes based on the hovered area. The update also includes a `useMagneticPull` hook for creating magnetic pull effects on elements.
The AI stack has three layers: application development, model development, and infrastructure. AI engineering focuses on adapting and evaluating models rather than just building them from scratch, including prompt engineering, evaluation, and AI interface design. AI engineering is becoming more accessible to software engineers, especially those with full-stack experience.
Spotify's Release team manages weekly app updates to over 675 million users through a structured two-week cycle. The process begins with trunk-based development and nightly builds to alpha users, followed by branching the release in week two for more intensive testing. Rollout happens in two phases: 1% of users, then 100%, as this allows quick issue identification while balancing speed and quality.
2025.05.21·
engineering.atspotify.com·12 min read·TLDR Web Dev
A developer built an interactive, browser-based 3D globe using scientific datasets and WebGL to visualize 100,000 years of Earth's history, including elevation, sea levels, climate, and ice sheets.
Microsoft's NLWeb project enables websites to provide a conversational interface for users with a few lines of code, the AI model of their choice, and their own data. Sites using NLWeb can make their content discoverable and accessible to platforms that support MCP. NLWeb could play a similar role to HTML for the agentic web and allow users to interact directly with web content in a rich, semantic manner. The NLWeb project started with OpenAI, which was working on an early version last November.
Apple's iPhone 17 Air, which is expected to launch later this year, will weigh approximately 145 grams. The 6.6-inch, 5.5 mm-thin device will have a battery capacity of 2,800mAh and may use Apple's power-efficient C1 modem. There have been mixed reports regarding the iPhone 17 Air's potential battery performance, but Apple apparently determined that 60% to 70% of users will be able to use the device for a full day without needing to recharge throughout the day. The company is reportedly planning to release a battery case as an optional accessory to mitigate this problem.
Nvidia's NVLink Fusion, introduced at Computex this week, opens the NVLink interconnect tech to non-Nvidia-designed accelerators. NVLink enables multiple GPUs in a system or rack to behave like a single accelerator with shared compute and memory resources. The technology will be offered in two configurations: the first will be for connecting custom CPUs to Nvidia GPUs, and the second involves using NVLink to connect Grace and Vera CPUs to non-Nvidia accelerators. This should theoretically open up the possibility of superchip-style compute assemblies that feature any combination of CPUs and GPUs as long as Nvidia technology is involved.
23andMe will be sold to Regeneron Pharmaceuticals for $256 million. The sale includes 23andMe's Total Health and Research Services business and biobank of customer data and genetic samples. 23andMe says that customer data is anonymized and stored genetic samples are destroyed when users delete their accounts, but it is unclear how much information is retained. Regeneron's co-founder said that the purchase will further the company's large-scale genetics research into future drugs and treatments. 23andMe has collected genetic samples and data from more than 15 million customers.