Socket found three malicious Go modules with hidden code that can download payloads to wipe a Linux system's primary disk (/dev/sda), making it unbootable. Attackers exploited the decentralized nature of the Go ecosystem and confusion around namespace validity to disguise malicious modules as legitimate. The payloads executed commands that wiped disks, causing irreversible data loss and severe disruptions for affected organizations.
Due to a security vulnerability, dating app Raw exposed users' personal data, including names and locations. Raw fixed the issue but hasn't committed to notifying affected users.
Harrods is the third major UK retailer facing cybersecurity issues in two weeks, following M&S and Co-op. The luxury store restricted internet access after unauthorized access attempts but kept stores open. While no organization has confirmed ransomware involvement, experts suggest Scattered Spider might be behind the attacks.
Daniel Card vibe-coded cybersecurity tools and educational games using AI (specifically GROK). These tools include a data visualization mapper for OSINT and attack surface mapping, SOC Chef (a collection of resources for security operations professionals), and an interactive timeline creation tool. He's also developed educational games like "Cyber Detective," "Attack the Net," and "Defend the Net" that demonstrate cybersecurity concepts from both attacker and defender perspectives, accomplishing in days what would have previously taken him weeks or months to develop.
Phishing-as-a-service toolkits allow criminals to bypass common multifactor authentication (MFA) through adversary-in-the-middle attacks. These tools create proxy servers that intercept credentials and MFA codes between victims and legitimate sites. While traditional MFA (one-time codes or push notifications) is vulnerable, WebAuthn-based authentication (passkeys) remains resistant because credentials are cryptographically bound to specific URLs and devices.
Slow Pisces is a North Korean hacking group primarily focused on generating revenue for the DPRK by targeting cryptocurrency organizations. A new campaign associated with Slow Pisces involves reaching out to cryptocurrency developers and directing them to a coding challenge that involves a malicious repository that downloads and runs a malicious C2 server. If the victim opts for a Python interview, the malware is launched via YAML deserialization, whereas if they opt for a JavaScript interview, the malware is loaded via ejs templates.
2025.05.05·unit42.paloaltonetworks.com·11 min read·TLDR InfoSec Sponsored
Black Duck addresses the strategic risks of AI-generated code with True Scale Application Security [13]. As a seven-year leader in the Gartner Magic Quadrant leader for Application Security Testing, Black Duck is the only choice for securing mission-critical software everywhere code happens. Discover how Black Duck delivers True Scale
LayerX provides AI-powered browser security to protect users from threats such as rogue extensions, gen-AI risks, data leakage, web threats and vulnerabilities, and more.
MCP for Security is a collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan, and more. Integrate security testing and penetration testing into AI workflows.
b3acon is an email-based C2 server that uses an in-memory, dynamically compiled C# IMAP client via PowerShell.
The author found and reported leaked secrets by scanning thousands of public GitHub repos for deleted files containing sensitive information. Using automation, they restored deleted files, searched for exposed credentials, and analyzed the Git history to recover secrets. This approach uncovered common causes of secret leaks, such as a lack of Git knowledge and accidental commits of binary files containing sensitive data.
Microsoft is replacing passwords with passwordless options like passkeys for new accounts by default. The initiative features a redesigned sign-in process optimized for passkeys. While existing accounts can keep passwords, Microsoft reports nearly one million daily passkey registrations with a 98% sign-in success rate versus 32% for passwords.
An xAI employee leaked an API key on GitHub that allowed access to private AI models custom-built for Elon Musk's companies (SpaceX, Tesla, and X). The leak remained active for two months despite alerts. The exposed models included unreleased versions of Grok and specialized AI tools containing proprietary company data.
Microsoft is phasing out password autofill in Authenticator and moving users to Edge by August 2025.
Major security firms like Amazon, CrowdStrike, Google, and Palo Alto Networks report no disruptions in sharing threat intelligence with the federal government under President Trump.
iHeartMedia is offering credit monitoring and identity theft protection to individuals impacted by a data breach in December that exposed personal information such as Social Security numbers.
Young adults aged 18-29 are struggling with happiness, financial stability, mental health, and a sense of purpose. In most countries, wellbeing improves only around age 50. Gen Z is the most financially stressed generation, with just 28.5% feeling financially comfortable. Yet, they still spend on things that bring joy. Flourishing is more common among those who are married, employed, or attend religious services. Brands that acknowledge their outlook and offer messages of meaning or joy are more likely to resonate.
Pinterest's delayed response to widespread account bans has made users more frustrated. Many reported they were locked out without explanation or clear guideline violations. Despite appeals, most remain unsuccessful, leading to speculation about flawed AI moderation and calls for greater transparency. Some users are now exploring legal action, citing lost income, projects, and years of saved content.
Micro games are an effective marketing tool because they capture attention, build emotional goodwill, and boost engagement without overtly selling. Wiz used a cybersecurity-themed game called Wizlympics to increase time on site and brand affinity, which helps with SEO and trust. Files.com created a Frogger-style game for trade shows that drew attendees in and made starting conversations easier. Micro games work best when they are simple, mobile-friendly, subtly branded, and used as conversation starters.
Atlas Privacy revived a cold email list of 160K leads with a single email that converted 8-12.5% into active users. It pre-created user accounts and allowed instant access via a one-click "Activate My Account" link, removing all friction. The email included specific reminders of when, where, and why users signed up, triggering recognition. The best-performing subject line was “Your Waitlist Application Was Approved”, leading to 100K monthly visits and top SEO rankings.
LinkedIn is rebranding its Wire program as BrandLink and expanding video ad placements to include influencer content, not just premium publishers. This move supports future creator monetization on the platform, starting with a small group of selected influencers. Time spent watching video on LinkedIn has grown 36% YoY, and video posts get 1.4X more engagement than other formats. Advertisers using BrandLink have seen a 130% higher video completion rate and 23% higher view rate compared to standard ads.
Reddit is scaling its AI-powered Answers feature to serve users who come to the platform for solutions (seekers), not just community interaction (scrollers). The tool already has 1M weekly active users and pulls direct content from posts to create summary-style answers that resemble Google results. This shift positions Reddit as a search-adjacent destination, making Reddit SEO and presence management more important for brand visibility.
Google is introducing a system that distinguishes between advertisers running campaigns and the organizations funding them. Payer names will be visible in ad disclosures and the Ads Transparency Center, marking a shift toward accountability and brand clarity. Marketing and finance teams will need to coordinate closely to ensure naming accuracy and avoid reputational or legal risks tied to verification errors.
Agencies like Once Upon a Time are using AI-driven tools such as Dragonfly AI to analyze visual attention in promotional materials for movies and series. Dragonfly tracks gaze paths and saliency to help refine key art and marketing content after creation, optimizing it for various platforms and stages of a title's lifecycle. This tool claims to enhance rather than replace human creativity, ensuring materials stand out without compromising storytelling. It aims to extend the longevity and impact of intellectual property by tailoring content for different markets and formats.
Google may avoid a forced breakup by agreeing to behavioral fixes like sharing real-time bid data and removing unified pricing rules that have constrained publisher pricing strategies since 2019. These proposed concessions could open up ad auctions to more competition and reduce Google's influence over ad pricing and prioritization.
Surveillance capitalism fuels a $274B data industry by monetizing users' emotions and vulnerabilities through hyper-targeted ads.
SAG-AFTRA launched a new influencer committee to unify creators and expand protections beyond branded content.
HTML doesn't have a native include feature similar to CSS' `@import` or JavaScript's `import`. There are numerous existing solutions for including HTML snippets, such as JavaScript, server-side directives, and static site generators, but none are pure HTML. This article explores the potential reasons for this, which include performance, security, and complexity concerns like circular dependencies.
The ScummVM project's server infrastructure faced a DDoS attack that saturated resources and brought down their website. The attack originated from numerous IP addresses, making traditional blocking methods ineffective, and the URLs targeted were resource-intensive. Anubis is a program that filters connections and uses a proof-of-work challenge to distinguish legitimate users from bots, which ended up mitigating the attack.
Shopify's MobileBridge framework transforms WebViews to feel more native by addressing three core issues: performance (reducing load times by 75% through preloading), appearance (removing web elements like zooming), and integration (having seamless web-mobile communication). This hybrid approach allows Shopify to maintain development speed while still delivering a near-native experience for non-critical screens in their app (which is one of the largest complaints of cross-platform frameworks like React Native).
Tech workers are losing their privileged status and facing increased exploitation. Tech companies are using AI as a narrative to justify layoffs, increase workloads, and reduce benefits for tech employees. New strategies may be needed for tech workers to protect their rights and working conditions.
Forcing Google to sell Chrome, despite its ad-market abuses, is a bad idea. Chrome won the browser war fairly through genuine innovation and its continued development is necessary for the web's advancement. Google's investment in the web is driven by self-interest and benefits the entire web in general.
Hardcover, a book tracking app, migrated from Next.js to Ruby on Rails with Inertia.js due to issues like unclear caching, unpredictable costs, and slow development speeds in Next.js. The move to Rails and Inertia.js allowed for server-side rendering, direct database connections, and continued use of React, resulting in improved Google Pagespeed scores and faster load times. Hardcover uses Rails for backend logic and routing, while Inertia.js connects the Rails backend with the React frontend for dynamic content.
Seyfert is a new type-safe Discord framework designed for fast bot development with low RAM usage, modern features, and a focus on the developer experience. It makes it easy to interact with the Discord API, has cache control, and supports Deno, Bun, and Node.
Cloudflare MCP servers allow users to connect to Cloudflare's services from an MCP client and manage their Cloudflare account using natural language commands.
Desktop Commander MCP is a tool that integrates with Claude Desktop to provide AI-powered terminal control, file system management, code editing, and task automation.
Riot Games is aggressively combating video game cheaters using its kernel-level anti-cheat system, Vanguard, which grants deep access to users' computers to detect and ban thousands of cheaters daily in games like Valorant. Riot uses strategies such as using Windows' security features, fingerprinting cheaters' hardware, infiltrating cheat communities, and even publicly discrediting cheat developers. It categorizes cheaters by the types of tools they use. The company strategically slows bans to keep cheat development from advancing too quickly.
GitHub is committed to making its CLI accessible to all devs, addressing the current gap in accessibility standards for terminal apps. The recent Public Preview focuses on improving the experience for users relying on screen readers, high contrast, and customizable color options. The company is rethinking prompts and progress indicators for screen readers and aligning color palettes with 4-bit colors for better user customization.
DuckDB's spatial extension has greatly lowered the barrier to entry for geospatial data analysis, which has contributed to a recent surge in interest and usage of geospatial tools.
An xAI employee inadvertently leaked an API key on GitHub, granting unauthorized access to private xAI large language models fine-tuned with data from SpaceX and Tesla for two months.
Breeze PDF is a free browser-based PDF editor that operates offline by processing documents locally without any uploads.
Using large language models for creative writing ruins the purpose of creative writing.
This developer created a simple, static blog generator using Python and Markdown without the complexity of other platforms to publish content easily on their own domain with modern web standards.
Sponsored
Enable sophisticated agentic flows with PayPal's new AI tools. Seamlessly integrate PayPal APIs (payments, invoices, disputes, subscriptions, reporting, and more) into your AI tooling and frameworks, and create next-generation shopping experiences.
2025.05.02·developer.paypal.com·TLDR …all led by a team of expert certified testers.
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [7] and ensure your business is always protected.
2025.05.02·threatspike.com·Sponsor·TLDR Google's new AI Mode takes Search's real-time information access and combines it with generative AI capabilities to create an AI search engine experience. It is designed to make it easier for users to plan vacations, shopping trips, or learn more about any topic. Google Labs users in the US can now access AI Mode without a waitlist. Feedback on the tool has so far been positive.
2025.05.02·zdnet.com·4 min read·TLDR