Search the archive

TEXAS CITY TAKES SYSTEMS OFFLINE AFTER CYBERATTACK

Abilene, Texas, suffered a cyberattack that caused server outages. Officials disconnected affected systems and hired cybersecurity experts. Emergency services remain operational, while card payment systems at government offices are currently unavailable. A complete recovery is expected to take several weeks.

SK TELECOM REVEALS CYBERATTACK, CUSTOMER USIM DATA STOLEN COULD BE USED IN ATTACKS

SK Telecom detected a malware attack targeting customer USIM data in mid-April. The company quickly isolated affected systems, notified authorities, and implemented security measures to prevent USIM swaps and suspicious authentication attempts. No data has appeared on the dark web, and no group has claimed responsibility for the incident.

GOOGLE FIXES CLOUD COMPOSER PRIVILEGE ESCALATION VULNERABILITY

Google has fixed a privilege escalation vulnerability impacting the Cloud Composer 2 managed workflow orchestration service. Cloud Composer allows any user with edit permissions to install a package from PyPi, which is then installed by Cloud Build. Prior to this fix, Cloud Build used the highly privileged default Cloud Build service account. An attacker could install a malicious PyPi package that exfiltrates the sensitive Cloud Build credentials.

HOW I MADE $64K FROM DELETED FILES — A BUG BOUNTY STORY

Security researcher Sharon Brizinov earned $64,000 by discovering secrets in deleted GitHub repository files. His research highlighted how Git retains copies of all files in its commit history, even after they are deleted from the working directory. Completely removing sensitive files requires specific tools, such as git filter-branch or git-filter-repo, as Git maintains references in its object storage for several weeks before performing garbage collection.

MCP: BUILDING YOUR SECOPS AI ECOSYSTEM

MCPs offer a standardized way for LLMs to interact with various tools, which can significantly aid SecOps teams in leveraging disparate security tools for investigations. AI Agents can currently perform specialized automations to complete tasks that require minimal human intervention, whereas MCPs can facilitate flexible workflows guided by humans. In the future, we may see vendors create more MCPs for their tooling, as well as a convergence between agents and MCPs.

GAINING LONG-TERM AWS ACCESS WITH CODEBUILD AND GITHUB

Attackers can exploit AWS CodeBuild and GitHub for persistent access after compromising an AWS account. They can modify an IAM role's trust policy to allow CodeBuild to assume it, link CodeBuild to an attacker-controlled GitHub repository, and create GitHub Actions workflows that execute commands using the permissions of the assumed role. This technique is more discreet than creating new IAM users with admin privileges, as the activity appears as legitimate CodeBuild operations from AWS infrastructure IPs, not external ones.

TERRA SECURITY (PRODUCT LAUNCH)

Terra uses AI agents for continuous web app pen testing tailored for an organization's environment and that adapts in real-time and autonomously runs tests when new vulnerabilities are discovered.

BUGFISH-NUKE

Bugfish-nuke is a Windows tool for emergency privacy that instantly deletes sensitive data and active logins to protect information during unexpected searches or warrantless seizures.

TEMPEST

Tempest is a C2 framework written entirely in Rust. It is designed for research and educational purposes.

GOOGLE WON'T DITCH THIRD-PARTY COOKIES IN CHROME AFTER ALL

Google has abandoned plans to replace third-party cookies with its Privacy Sandbox initiative after years of development struggles. Initially proposed in 2019, the company's alternatives, like FLoC and Topics API, faced criticism and delays. Google will now maintain cookie support indefinitely while continuing to develop privacy features for Incognito.

DPRK HACKERS STEAL $137M FROM TRON USERS IN SINGLE-DAY PHISHING ATTACK

North Korean hackers are targeting cryptocurrency organizations to generate funds amid international sanctions. Google's Mandiant identified multiple threat groups using custom malware tools across Windows, Linux, and macOS to infiltrate Web3 companies and steal large amounts of TRON.

OUTSIDE EXPERTS PICK UP THE SLACK ON TESTING OPENAI'S NEWEST MODEL RELEASE

AI red teaming company SplxAI chose to publish its own testing after OpenAI failed to publish a safety report for GPT-4.1 as it did for 4.0. SplxAI used the same prompts from its 4.0 testing to simulate a financial advisor and evaluate its safety in 11 categories across 1,000 simulated tests. GPT-4.1 performed 3x worse than GPT-4.0. Following OpenAI's guidance that 4.1 may require more explicit prompting, the SplxAI team developed a 1,400-word prompt over 5 hours of iterating that performed better than their initial prompt.

RANSOMWARE SURGE HITS US HEALTHCARE: AOA, DAVITA, AND BELL AMBULANCE BREACHED

Healthcare organizations in the US, including AOA, DaVita, and Bell Ambulance, were hit by ransomware attacks in 2025, affecting over 245,000 individuals and compromising sensitive patient data.

RUSSIAN HACKERS EXPLOIT MICROSOFT OAUTH TO TARGET UKRAINE ALLIES VIA SIGNAL AND WHATSAPP

Russian hackers are employing social engineering tactics, including impersonation and the use of messaging apps, to access Microsoft 365 accounts belonging to individuals and organizations associated with Ukraine.

1.33M OUTDATED DEVICES TURNED INTO THE LARGEST EVER BOTNET ATTACK

A huge botnet of 1.33 million outdated devices is wreaking havoc on global cybersecurity by executing unprecedented DDoS attacks.

APPLE, META FINED AS EU PRESSES AHEAD WITH TECH PROBES

The EU fined Apple €500 million ($570 million) and Meta €200 million for violating the Digital Markets Act, which aims to limit Big Tech's dominance. Apple was penalized for restricting developers from offering cheaper deals outside its App Store, while Meta's "pay-or-consent" ad model was found non-compliant. Both companies plan to challenge the fines, calling them unfair and harmful to innovation. The EU's actions come amid political tension with the U.S., as regulators push forward with enforcement despite threats of retaliation.

OPENAI WANTS TO BUY CHROME AND MAKE IT AN “AI-FIRST” EXPERIENCE

OpenAI has expressed interest in acquiring Chrome if regulators force Google to divest the browser as part of antitrust remedies. With plans for deeper integration of agentic AI models and product distribution, owning Chrome would allow OpenAI to embed ChatGPT at scale and collect user interaction data.

YOUR PRODUCT'S BENEFITS MUST SEEM RELATED

Products with multiple, related benefits sell better than those with a single benefit or multiple unrelated ones. In a study of 1,059 healthcare products, those with related benefits saw 42% higher sales, while those with unrelated benefits had 66% fewer orders. Consumers preferred and recommended items like cold medicine or maternity services more when their benefits were clearly linked. However, this effect disappears with low-quality items or when benefits feel disconnected.

UNDENIABLE CONTRAST

To grab a buyer's attention, use undeniable contrast. Highlight the shift from old to new, manual to automated, or before vs. after. Make the pain specific by emphasizing tangible issues like "30 minutes of manual follow-up." Lead with outcomes, not features. Buyers care about time saved, not just automation. Display the shift side-by-side to make the impact instantly clear. This approach conveys the value of your product in a quick and compelling way.

7 CONTENT REPURPOSING TACTICS TO CREATE 40+ PIECES OF CONTENT PER WEEK

By prioritizing idea-first planning and structured repurposing, a single concept or idea can yield 15 assets including carousels, infographics, videos, and newsletters. Efficiency comes from reusing outlines, frequently tracking engagement data to guide topics, and leveraging one central content piece to power multi-month campaigns. The model reduces workload, improves message coherence, and drives monetization through repeatable workflows.

INTRODUCING EDITS: MAKE GREAT VIDEOS ON YOUR PHONE

Instagram's Edits is a new app designed to simplify short-form video creation. Features include a high-quality camera, precise editing tools, trending audio inspiration, and performance insights. Built with creator feedback, Edits will soon add keyframes, AI tools, collaboration features, and expanded creative options. It's free and available globally.

18 MONTHS OF B2B MARKETING EXPERIMENTS: WHAT WORKED, WHAT DIDN'T, AND WHY (WEBINAR)

This webinar on May 1 will look at 18 months of real marketing experiments. The hosts will be unpacking what worked, what flopped, and why, across paid, creative, and OOH channels. It's designed to help you run better experiments in your own marketing.

BRANDS NEED TO RETHINK ENGAGEMENT BEYOND THE FEED

Declining engagement is often caused by content that fails to spark reaction rather than algorithm shifts in the platform. Many brands still focus on visibility instead of interaction, missing the fact that real engagement happens in comments, DMs, and group chats instead of the feed. The most valuable signals are relationship-based, not reach-based, and brands ignoring these interactions are missing the most insightful audience feedback.

CLOSING THE CONTENT GAP: WHAT WE LEARNED FROM TALKING TO 400+ GTM PROS

While content marketing is valued, there's a disconnect between content teams and the broader org. Most GTM teammates want to be involved in content creation, but only half have had a good experience doing so. Content marketers feel their work is undervalued, especially when it comes to long-term impact like brand awareness. Both sides agree that content is a key revenue driver. Higher quality, audience-first content and stronger collaboration across teams is needed to truly close the gap.

ALL THE THINGS PEOPLE USE AI FOR IN 2025

AI is increasingly being used for emotional and personal support, with therapy, life organization, and finding purpose ranking as the top three use cases.

15 YEAR HISTORY OF GTM

A timeline of the evolution of B2B GTM in the last 15 years.

SLAY FRAMEWORK FOR LI POSTS

Write viral LinkedIn posts by focusing on a story, presenting a lesson, providing actionable advice, and finishing with a question.

Join the waitlist to try it first.

REACT LABS: VIEW TRANSITIONS, ACTIVITY, AND MORE

HOW A 20-YEAR-OLD BUG IN GTA SAN ANDREAS SURFACED IN WINDOWS 11 24H2

A 20-year-old bug in GTA San Andreas that causes the Skimmer plane to disappear in-game has surfaced in Windows 11 24H2. The root cause has been traced to missing wheel scale parameters in the vehicles.ide file for the Skimmer, which went unnoticed due to the game's incomplete data validation. The bug was triggered by changes in Windows 11 24H2's internal stack management, which overwrote uninitialized values that the game unintentionally relied upon.

MCPS, GATEKEEPERS, AND THE FUTURE OF AI

Model Context Protocols (MCPs) are standardized APIs connecting external data sources and applications to LLMs. The current user experience and security of MCPs are not good enough yet for widespread adoption. The power will be with client-side interfaces like ChatGPT and Claude, who control which MCPs are used and how their responses are displayed. LLM providers will act as gatekeepers, managing MCP selection and monetization similar to app stores and search engines.

THE HIDDEN COST OF AI CODING

The increasing use of AI coding tools has worsened the feeling of "flow" by this developer. The productivity gains of AI are great, but this developer is worried about getting detached from their craft and gaining less fulfillment out of coding.

REACT COMPILER RC

The React team has released React Compiler RC, a near-final version of their build-time tool that optimizes React apps through automatic memoization. This release includes improvements like support for optional chains and array indices as dependencies, easier integration, and the merging of `eslint-plugin-react-compiler` into `eslint-plugin-react-hooks`. The compiler is compatible with React 17 and up and supports various build tools like Babel and swc.

LEGEND LIST

Legend List is a high-performance, TypeScript-based React Native list component designed as a drop-in replacement for FlatList and FlashList. It has great performance, especially with dynamically sized items, and supports bidirectional infinite lists and chat UIs without inverted scrolling. The library is lightweight, 100% JavaScript, and requires no native module linking. It has features like item recycling and scroll maintenance at the end for chat interfaces.

MOOSE

Moose is a TypeScript/Python framework that simplifies building analytical backends by automatically managing data infrastructure like APIs, streaming, and databases from a single code model.

DOGE WORKER'S CODE SUPPORTS NLRB WHISTLEBLOWER

A whistleblower at the NLRB alleges that Elon Musk's DOGE accessed sensitive NLRB case files and downloaded code libraries, including one very similar to a program by DOGE employee Marko Elez. The code, designed for generating pseudo-infinite IPs, could be used for web scraping and brute force attacks. The DOGE accounts had unrestricted permissions to read, copy, and alter information. The code found supports the NLRB whistleblower's claim.

DOES USING RUST REALLY MAKE YOUR SOFTWARE SAFER?

Rust can improve software safety by preventing vulnerabilities. The NAME:WRECK vulnerability in the Nucleus real-time operating system is a good case study. An experiment was conducted where engineers rewrote a vulnerable DNS decoding routine in Rust to show how Rust's memory safety and expressive language reduced the likelihood of introducing vulnerabilities. Rust implementations avoided arbitrary code execution vulnerabilities and resulted in recoverable errors, saving time and money compared to a secure C implementation.

INDEX

Index is an open-source browser agent powered by reasoning LLMs with vision capabilities designed to autonomously execute complex tasks on the web.

PIXEL IS A UNIT OF LENGTH AND AREA

The overloaded use of "pixel" as both a linear and area unit in digital imaging creates a mathematical inconsistency.

NATIVE VISIONOS PLATFORM SUPPORT

Apple's visionOS engineering team has created a PR to add native visionOS platform support to the Godot engine, starting with a foundational PR that uses iOS code and lays the groundwork for future immersive VR capabilities.

HOW I WRITE MY BLOGS IN OBSIDIAN AND PUBLISH INSTANTLY

This post outlines a system for writing blog posts in Obsidian, publishing them via Hugo and GitHub, and deploying them with Cloudflare Pages, for free.

OPENAI WANTS TO BUY CHROME AND MAKE IT AN “AI-FIRST” EXPERIENCE

When asked if OpenAI would join in the bidding if Google had to sell Chrome, OpenAI's head of product for ChatGPT Nick Turley said unequivocally that the company would. OpenAI has reportedly been considering building its own Chromium-based browser to compete with Chrome. Having a browser would give OpenAI a massive install base of users and the user data flowing through the browser would be invaluable in training agentic AI models that can operate browsers on users' behalf. There's a lot of discussion about who should buy Chrome, but relatively little about spinning it off into an independent company - despite Google's claims, the existence of its multibillion-dollar search placement deals indicates the browser can survive on its own.

MICROSOFT CRACKS DOWN ON LOW PERFORMERS WITH NEW EXIT STRATEGY: CHECK DETAILS

Microsoft has rolled out stricter internal policies to reinforce its performance management system. The new guidelines help managers address underperformance more decisively while rewarding high achievers more clearly. Changes include a tougher exit policy for employees consistently rated in the lowest performance bracket and the introduction of performance-related tools aimed at increasing transparency and consistency in evaluations and rewards. Microsoft is developing AI-powered training tools that simulate real-life feedback scenarios to help improve confidence and communication during performance discussions.

A CHINESE-BORN CRYPTO TYCOON—OF ALL PEOPLE—CHANGED THE WAY I THINK OF SPACE

Earlier this month, an international crew of four private astronauts took a journey into space aboard a SpaceX Dragon spacecraft. Chun Wang, a Chinese-born cryptocurrency billionaire, paid SpaceX an undisclosed sum for the mission to fly into orbit with three of his friends. The mission was named Fram2 after the Norwegian exploration ship Fram used for polar expeditions at the turn of the 20th century. It orbited over Earth's pole for a perspective on the planet that no human eyes had seen before. This article details what happened on the mission - footage from the mission is available.

THE SECRETS OF LAB-GROWN CHOCOLATE

Lab-grown chocolate could rival traditional chocolate in several ways. The process can grow cells that multiply swiftly and mature within a week, as opposed to the six to eight months usually required for a conventional cocoa crop. The resulting product can also contain higher levels of health-promoting chemicals and fewer contaminants such as heavy metals or pesticides. The price of cocoa is skyrocketing as the industry deals with drought and other problems.

HOW TO RUN PYTHON IN PRODUCTION

Python is the dominant option for running production workloads for data analysis and machine learning. This article contains several lessons on how to run Python in production. It covers how to maintain project quality, ensure project maintainability, and deploy.

NERDLOG

Nerdlog is a fast, remote-first, multi-host TUI log viewer laser-focused on being efficient. It can query logs from multiple remote machines simultaneously, filter them by time range and patterns, and draw timeline histograms for quick visual insight. Nerdlog establishes an SSH connection to every node that the user wants to collect logs from and keeps them idle in the background so there's no need for a centralized server. Logs are not downloaded to the local machine in full and all log analysis is done on the remote nodes.