Search the archive

Invest at $3.30/share before 10/23

AMD ACQUIRES WORLD LABS

AMD has agreed to acquire World Labs, a startup specializing in spatial intelligence and deep learning models designed to understand the physical three-dimensional world. This merger aims to build an open, end-to-end AI ecosystem by combining frontier physical intelligence research directly with high-performance silicon development. This acquisition is exceptionally relevant to those building physical machines because it bridges the gap between hardware acceleration and the spatial awareness foundation models required for next-generation robotic manipulation and navigation.

NEW ROS 2 NODE DEFINITION LANGUAGE FRAMEWORK

Announced at ROSCon Global 2026 in Toronto, the NODL framework provides a metadata language to formally describe the ROS interface of a robotic node, including its topics, parameters, services, and actions. It allows developer tools to validate configuration layouts, auto-generate boilerplate code, and create automated testing setups directly from declarative node specifications. For anyone designing embedded control software or complex sensor integrations, this tool offers a standardized way to ensure subsystem nodes communicate reliably without manual, error-prone integration checks.

TSMC'S 2024 $1T-BY-2030 FORECAST WAS ALREADY $700B TOO LOW

At TSMC's OIP North America symposium, VP Sajiv Dalal now projects the semiconductor industry hitting roughly $1.7 trillion by year-end, with AI alone crossing $1 trillion, dwarfing TSMC's own "aggressive" 2024 forecast of $1 trillion for the whole industry by 2030. TSMC's revenue is up 53.3% year-over-year through August, and new tape-outs have quadrupled across the N5, N3, and N2 nodes, with N2 seeing an especially sharp acceleration in new chip designs.

VAST DATA'S DATAENCLAVE USES NVIDIA CONFIDENTIAL COMPUTING TO RUN AI MODELS DIRECTLY INSIDE LOCKED-DOWN DATA

VAST Data unveiled DataEnclave, a confidential AI runtime built on NVIDIA Confidential Computing, aimed at industries like finance, healthcare, and government where sensitive data can't leave tightly controlled environments and outside AI models normally can't reach it. The system creates hardware-isolated secure enclaves using CPU and GPU trusted execution environments, requiring cryptographic attestation that verifies the environment and its enforced policy before any decryption key is released, so proprietary model weights and sensitive customer data get decrypted only inside a verified enclave and stay encrypted in both CPU and GPU memory while processing, invisible even to the infrastructure operator running the hardware.

SAMSUNG ELECTRO-MECHANICS INVESTS 6.78 TRILLION WON IN AI CHIP PACKAGE SUBSTRATES

Samsung Electro-Mechanics is investing a combined 6.78 trillion won ($4.9 billion) to expand FC-BGA substrate production, 4.27 trillion won for a new plant at its Sejong site, and 2.51 trillion won for its Vietnam subsidiary, marking the company's largest-ever investment in a single product.

CERN RELEASES "COLIBRI," A VENDOR-INDEPENDENT VHDL COMMON LIBRARY FOR FPGAS

CERN's EP department released colibri, a VHDL common library built up over four years after gateware designers found themselves relying on homebrew tools scattered across FPGAs from multiple vendors.

ENTERPRISE RED HAT LINUX SUPPORT FOR ROS 2

Red Hat Enterprise Linux has officially achieved Tier 1 support status in the Robot Operating System 2 development ecosystem, beginning with the Rolling Ridley release.

MASTERING THE ROS RMW WORKSHOP

This repository contains the training materials, benchmarks, and hands-on exercises for a technical workshop focused on tuning ROS 2 middleware performance.

GET THE TECHNICAL ARTICLE →

how Gateway Load Balancer and FORTIGATE NEXT-GENERATION FIREWALL

consolidate it all into a single dashboard. SEE HOW THE DEPLOYMENT WORKS: * GATEWAY LOAD BALANCER INTEGRATION: Route traffic to a FortiGate security VPC for unified inspection * UNIFIED SECURITY PROFILES: Configure routing tables and shared policies across cloud and on-premises * REAL-TIME DETECTION AND RESPONSE: Monitor threats and take action from a single FortiGate dashboard

PENTAGON PERSONNEL AGENCY DATA BREACH IMPACTS 3 MILLION PEOPLE

The Defense Manpower Data Center exposed unencrypted personal data through a vulnerable file-sharing server. Unauthorized users accessed files between October 2025 and July 16, 2026. Records included Social Security numbers, names, birth dates, contact details, demographic data, and military specialties. The breach affects 2.76 million living people and 294,000 deceased individuals.

OFFICIAL MCP PYTHON SDK FLAW CAN LET MALICIOUS SERVERS STEAL OAUTH CREDENTIALS

A high-severity flaw in the official MCP Python SDK let malicious MCP servers redirect OAuth token requests to attacker-controlled endpoints. Affected 1.x (1.9.1–1.29.1) and 2.x (2.0.0–2.1.1) clients sent the client secret, authorization code, and PKCE proof key to the attacker, enabling full account takeover with the app's granted permissions. Fixes are in 1.30.0 and 2.2.0. ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider also require passing issuer= to pin the expected login service.

AUTOMATED AI AGENT USED TO BREAD CYBERSECURITY NONPROFIT DIVD

The Dutch Institute for Vulnerability Defense (DIVD) reported that they suffered an AI-driven breach. The organization said that the breach was “loud and very, very messy” with the agent working autonomously and over explaining itself in comments, allowing the DIVD to easily reverse-engineer its attack. The threat actor exploited a vulnerability in a vulnerability in an undisclosed software that the organization stated was not Citrix NetScaler.

ATTACKERS ABUSE CHATGPT CUSTOM GPTS TO DELIVER RAT VIA CLICKFIX

Sponsored Google results led victims to "Plus 5.6," a Custom GPT on chatgpt.com that answered every prompt with a fake outage notice pointing to a Google Sites ClickFix lure, and Huntress tied at least 40 incidents to the campaign. The eight-stage chain sideloaded malicious DLLs through Canon-signed (later Stardock-signed) binaries, hid its loader inside a WAV file and a NuGet package. It then unpacked a full-featured RAT from a custom encrypted file system that located its C2 over DNS-over-HTTPS. The signed hosts change with each wave, so defenders should detect behaviors instead: PowerShell spawning msiexec on GUID-named MSIs in %TEMP%, signed apps running from fake %LOCALAPPDATA%\Programs folders, and self-restoring Run key and scheduled task pairs, which require killing the process before removing persistence.

NEEDYMANTIS: UNPACKING A POST-COMPROMISE MALWARE FAMILY USED IN TARGETED OPERATIONS

NeedyMantis is a modular post-compromise malware family deployed since at least October 2025 by China-based actors, including Storm-3069 from the DAEMON Tools supply chain compromise, against telecoms, universities, intergovernmental organizations, and government contractors. It was sideloaded as fake DLLs alongside legitimate software like Poedit, curl, Vim, and TightVNC, then unpacked from custom XOR-encrypted archives through shellcode loaders into a stripped-down PE format, and communicated over WebSockets with RC4-encrypted traffic and loadable modules. Defenders should hunt for spoofed DLLs such as WinSparkle.dll or libcurl.dll in unusual ProgramData paths, the hard-coded "firefox/21.0" user agent, and connections to corp.tripswithengine[.]com.

AI AGENTS ARE PRIVILEGED USERS; WHO IS AUDITING THEIR ACCESS?

Enterprises monitor human logins closely but often grant autonomous AI agents broad production access via long-lived service accounts and API tokens. These agents can initiate, approve, and execute high-value actions end-to-end, collapsing segregation of duties. The piece lays out six controls: isolate agent identities, scope permissions to the minimum needed, assign a business owner, log prompts and tool calls, run periodic access reviews, and build an out-of-band kill switch.

[Join the Tailscale PAM beta waitlist]

RIG SECURITY (PRODUCT LAUNCH)

Rig Security provides an identity protection platform for agentic AI. It maps identity dependencies across providers, cloud, on-prem, network edges, and endpoints. A lightweight sensor distinguishes AI agent sessions from human sessions and enforces policy at runtime, and the system blocks risky agent actions without disabling the human account.

MALICIOUS DRIVERS (WEB APP)

A searchable list of tracked, signed, and abused kernel drivers.

CRYPTOPTIC

cryptoptic is a tool that uses CodeQL, orchestrated via GitHub Actions, to scan a repository or entire GitHub organization and produce an inventory of every cryptographic function in use, the library it comes from, and when it gets called.

24-YEAR-OLD ARRESTED IN DUTCH INVESTIGATION INTO SHINYHUNTERS

Dutch police arrested a 24-year-old Amsterdam man, identified by multiple sources as Pepijn van der Stap (aka “Umbreon”), in connection with the ShinyHunters hacking group. He previously served time for extorting over a dozen companies, earning €1.5–2.7 million, and was released in December while still facing civil suits.

FBI REPORTEDLY DECLARES ‘CYBER SECURITY INCIDENT' AFTER HACKERS STEAL AGENTS' PERSONAL DATA

The FBI told staff that a hack of its FBIJobs.gov portal exposed agents' and applicants' names, addresses, job titles, Social Security numbers, and some medical records, including blood and urine samples and psychiatric reports. ShinyHunters says it exploited an Oracle PeopleSoft vulnerability and is not demanding money, but wants the bureau to correct an earlier report about its activities. The portal remains offline, and the bureau has not publicly confirmed whether the breach meets the legal threshold for a “major incident” requiring notification to Congress.

OPENAI SCRAPS ROLLOUT OF NEW AI MODEL OVER SAFETY CONCERNS

OpenAI will not release GPT-6.1 Astra after tests found problems with scope, authorisation, and reporting completed work.

JADEPUFFER CRIMS HIJACKED AZURE IDENTITIES AND USED THEM TO BLOW UP CLOUD RESOURCES

Microsoft linked Storm-3168, the actor behind JadePuffer (the first documented agentic ransomware), to an 18-hour June attack in which two hijacked Azure service principals were used for reconnaissance and then destruction, likely after an employee exposed client secrets in a public GitHub issue.

NVIDIA OPEN AGENT SAFETY PLATFORM: A REFERENCE FOR CONTINUOUS IN-SILICON AGENT MONITORING

NVIDIA's Open Agent Safety Platform pairs OpenShell, an Apache 2.0 sandboxed runtime that turns operator instructions into verifiable file, network, tool, and credential policies, with Sentry, a monitor that runs on BlueField-4 DPUs. In Vera Rubin PODs, the DPU sits on the node's only path to the model, so it can enforce policy at line speed outside the agent's reach. NVIDIA's argument is that agents can't be trusted to govern themselves, so safety controls have to sit below them in hardware.

MICROSOFT'S COPILOT SUPER APP COMES WITH A METER ATTACHED

Microsoft is splitting Copilot pricing in two. A per-user subscription still covers "Everyday AI" in Office apps, while agentic features like Cowork, Code, Autopilot, and frontier models are billed by usage on top of the seat. Admins get spending caps and alerts, but budgets that were fixed per head now have to absorb costs from agents that run without a user prompting them.

WHAT HAPPENS WHEN THE CLOUD BLOWS UP?

Missile and drone strikes during the March 2026 Iran conflict hit AWS facilities in the UAE and Bahrain. AWS says the damage exceeded what its multi-AZ design can withstand, and restoration isn't expected until early 2027. The piece argues that availability zones don't fail independently when a whole region is physically attacked, and that continuity plans should account for that.

TEST-DRIVING JEV ON A SECURITY TASK: IDENTITY RESOLUTION

Vincenzo Iozzo tested Jev, a specialized classification model, on matching accounts across systems to the same person in five real organizations. Jev scored 0.948 F1 on large orgs at $0.62 per 1,000 accounts, beating Claude Haiku 4.5 (0.894 F1, 19x the cost) and Sonnet 5 (0.911 F1, 47x the cost) at roughly a tenth of their latency. His conclusion is that small calibrated models beat prompted frontier LLMs on bounded, high-volume security classification.

MICROSOFT ANNOUNCES GENERAL AVAILABILITY OF WSLC: LINUX CONTAINERS ON WINDOWS

WSLC, Microsoft's native way to run Linux containers on Windows, is now generally available through a new wslc.exe command. Each session gets its own storage VHD, stronger isolation, and a new networking model compared with standard WSL. The code is open source in the microsoft/wsl GitHub repository.

INTRODUCING THREAT SIGNALS: AGENTIC SKILLS FOR OPEN-SOURCE THREAT INTELLIGENCE, FREE FOR EVERY CLOUDFLARE ACCOUNT

Cloudflare's Threat Signals uses agentic skills to read open-source threat reports from RSS feeds, summarize them, extract indicators of compromise, and tag threats. It then links those findings to WAF rules while keeping the context of the original source. Cloudflare also made its Threat Events Platform free for every account, with paid tiers for more feeds, proprietary data, and custom skills.

BUILDING A POST-QUANTUM CERTIFICATE AUTHORITY WITH MERKLE TREE CERTIFICATES

Cloudflare is becoming a certificate authority that issues Merkle Tree Certificates for free, and it is targeting Chrome's quantum-resistant root store in early 2027. Post-quantum signatures are about 40x larger than classical ones, so MTCs batch many certificates under a single CA signature and build transparency logging into issuance. In a Chrome experiment covering 50% of Beta users, the lightweight MTC format already made handshakes 9% faster.

GOOGLE SEEMINGLY CONFIRMS PLANS TO KILL CHROMEOS IN 2034

A new Google support page for enterprise and education customers says ChromeOS support will continue through mid-2034, and newer Chromebooks will be migrated to the Android-based Googlebook OS. This is a problem for schools, because Googlebooks start at $899 and won't have comparable management tools for a year or more.

A DATA CENTER IS A DEPENDENCY GRAPH BEFORE IT IS A BUILDING

A finished hyperscale region can sit idle for 6 to 12 months because hundreds of interdependent services have to come up in the right order, and some depend on each other, such as DNS relying on inventory while inventory relies on DNS.

AGENT MEMORY IS A SEARCH PROBLEM, NOT A STORAGE PROBLEM

Tiger Data skipped fact extraction, knowledge graphs, and memory managers.

HOW TO ROLL OUT GENIE ONE: A STEP-BY-STEP ENTERPRISE PLAYBOOK

Databricks published a four-phase rollout plan for Genie One, its AI coworker for business data questions.

Download the new plugin in Claude here.

WHO GETS PAID WHEN AI DOES THE SHOPPING?

AI shopping assistants could weaken marketplaces' advertising and commission economics by owning the customer relationship and sending orders directly to fulfillment providers. Amazon generated $69 billion in advertising revenue in 2025, so losing control of product discovery could threaten a major profit pool even if it keeps fulfilling orders. Platforms like Shopify and Toast have more reason to welcome agents because they can gain new sales while still earning software and payments revenue. The outcome depends on whether agents create new demand or simply reroute existing orders, since new purchases can offset lower profit per order.

WALMART'S COLLECTIBLES PLAY IS SHOWING US WHERE RETAIL IS HEADING

Walmart is using limited-time draws to sell scarce collectibles, including basketball cards, NeeDoh toys, and Pokémon boxes. Shoppers enter during a set window and are randomly selected instead of racing to checkout. The format creates anticipation and gives collectors a reason to discuss entry rules and results online. It shows how intentional friction can turn scarce products into experiences rather than simple transactions.

HOW B2B CREATOR MARKETING BUILDS BUYER TRUST ON LINKEDIN

B2B buyers increasingly use creators for both early research and later-stage validation. However, 80% of B2B marketers say finding credible creators is their biggest hurdle. LinkedIn recommends using Creator Marketplace to vet experts by industry, role, and audience, then amplifying their content with Thought Leader Ads or BrandLink. Thought Leader Ads deliver a 252% higher CTR than standard image ads, while BrandLink campaigns see 130% higher video completion rates than in-feed ads.

I WENT MINI VIRAL ON SUBSTACK (AFTER 9 MONTHS OF CRICKETS)

The author grew her Substack from 90 to 770 subscribers in four days. She did it with a reintroduction post featuring a photo, recognizable past employers, and an honest story about leaving corporate work. She then shared subscriber numbers in real time to keep momentum going. To stay consistent, she built a Claude Skill to help create Substack notes on a set cadence, then had a VA schedule them. An email is required to read the full post.

MONEY-BACK GUARANTEE VS. FREE TRIAL: WHICH SHOULD YOUR SUBSCRIPTION APP RUN?

Asking users to pay upfront with a refund safety net lets ad campaigns optimize for real purchases instead of trial starts, giving Meta and TikTok a cleaner signal of who will pay. Few customers claim refunds, so a lower conversion rate can be offset by higher-intent subscribers. Guarantees work best in web or app-to-web funnels, since the app stores control in-app refunds.

JEV: DECISION AI FOR GTM

Jev is a new decision model that returns labels, scores, and yes/no answers with calibrated confidence instead of generated text, making it a cheap fit for classification and routing in Clay. It connects through an HTTP API column in about 10 minutes. Keep the input state short, since extra context can lower accuracy. Add an "unclear" option and write criteria that don't overlap. Set stricter confidence thresholds for hard-to-undo actions, then gate paid enrichment and LLM writing on the result.

AI AND THE AGENCY OF THE FUTURE (WEBINAR)

Blin Kazazi and Dan Hinckley will discuss where AI fits inside an agency today. They'll cover what's changing in search and client demand, what the agency of the future looks like, and what agency owners get wrong about AI. The free webinar will take place today at 11 AM CT.

LINKEDIN IS MY MEDIUM

An artist created an AI-generated version of herself who is more polished and corporate than her real-world self. She uses AI to generate LinkedIn posts and images depicting promotions, luxury offices, leadership roles, and eventually a corporate scandal. The project satirizes LinkedIn's culture of self-promotion and professional visibility while questioning where performance ends and genuine professional identity begins. The irony is that the satire itself generates visibility and could make the artist more employable.

WHY STRONG PMMS ARE STRUGGLING TO LAND JOBS (AND WHAT TO DO ABOUT IT)

Strong PMMs are struggling to land jobs because companies are hiring cautiously and looking for candidates who fit specific business needs. Job seekers experience three common roadblocks: broad positioning, forgettable interviews, and explaining experience instead of demonstrating how you would solve the company's problems. The author recommends targeting your positioning around a specific type of company and using a consultative interview approach that diagnoses the company's needs, then structures answers around Process, Situation, Action, and Result. You can also stand out by creating concrete proof of how you would solve a company's problems, such as one candidate who built an ROI calculator for a final interview and had it shared across the company.