Search the archive

PASSKEYS & SECURE ENCLAVE WALLETS ON ETHEREUM

EIP-7951 will add native support for the p-256 signature scheme to Ethereum, the same curve used by Apple, Google, and WebAuthn.

OPENCV FOUNDERS LAUNCH AI VIDEO STARTUP TO TAKE ON OPENAI AND GOOGLE

CraftStory, founded by the creators of OpenCV, emerged from stealth with $2 million in funding and technology that generates realistic, human-centric videos up to 5 minutes long. The startup uses a parallelized diffusion architecture that runs multiple algorithms simultaneously across the entire video duration, trained on proprietary high-quality footage rather than internet-scraped data. CraftStory targets enterprise customers needing longer training videos and product demonstrations, offering a video-to-video system that animates still images using driving videos as motion templates.

AIGA NY UNVEILS NEW IDENTITY ROOTED IN COMMUNITY AND NEW YORK'S CREATIVE ENERGY

AIGA NY has launched its first major rebrand in nearly 20 years, introducing a new logo and strategy that emphasises community, visibility, and open dialogue. Designed by Christopher Guerrero, the identity creates a “town square” of negative space around the classic AIGA box and uses colours inspired by New York's streets. The chapter positions itself as a civic hub for designers and has formalised three pillars—elevating diverse voices, celebrating design excellence, and advocating for stronger industry standards—as the refresh rolls out across its platforms.

WARNER MUSIC GROUP AND STABILITY AI JOIN FORCES TO BUILD THE NEXT GENERATION OF RESPONSIBLE AI TOOLS FOR MUSIC CREATION

Warner Music Group and Stability AI announced a partnership to develop responsible AI music-creation tools using ethically trained models that protect creators' rights while enabling new forms of artistic expression. The collaboration will involve working directly with artists to shape professional-grade tools that enhance creative processes without compromising quality or artistic control. Stability AI's commercially safe generative audio models, trained exclusively on licensed data, will form the foundation for these artist-friendly tools.

CREATIVITY MEETS PRECISION WITH GOOGLE'S NANO BANANA PRO

Google's Gemini 3 Pro with Nano Banana now integrates across Figma's products, enabling designers to generate style variations and make precise edits while preserving brand consistency and visual coherence. The model excels at retaining design elements like palette, texture, and composition when creating new directions, and handles challenging tasks like adapting illustrations for dark mode or updating profile photos to match existing styles. Users on paid Figma plans can access Nano Banana Pro across all Figma products for contextual image generation and refinement.

EXPOSURE

Designers limit their effectiveness by spending too much time with other designers rather than engaging with product managers, engineers, sales teams, and customers who possess crucial context on user needs and business realities. Increased exposure to diverse perspectives reveals insights that pure design skills cannot, enabling designers to create solutions that actually solve the right problems. The most creative and effective designers aren't just technically skilled, they actively seek knowledge from people who understand different aspects of the product, market, and user context.

APPLE JUST ACCIDENTALLY CHANGED THE FUTURE OF SMARTPHONE DESIGN

The iPhone Air, despite its sleek design, has struggled with poor sales and hardware compromises like limited battery life, a single camera, and mono speakers, prompting several manufacturers—including Xiaomi, Vivo, and Samsung—to cancel or freeze their own ultra-thin phone projects. This suggests Apple's latest ultra-slim design may be influencing the wider industry away from pursuing similar devices, highlighting how even a visually striking gadget can have unintended consequences when practicality falls short.

CREATE PROFESSIONAL VIDEO ADS IN MINUTES

Turn your ideas into high-converting video ads instantly. No editing skills required. Just describe your business and let AI do the rest.

YOUR PERSONAL AI MARKETING AGENT

Automate customer acquisition tasks with AI marketing tools. Build workflows, generate content, analyze data, and scale your growth.

ACCESSIBILITY SUPPORT

A community-driven website that aims to help inform developers about what code features (roles, states, properties, elements, etc.) are supported by assistive technologies, and what that support looks like.

THE HIDDEN COST OF SHIPPING TOO FAST

In many startups, teams prioritize speed without establishing shared clarity about the problem being solved, leading to opinion-based decision-making, weakened craft, and months of repair work that negate any initial time savings. When clarity is absent, senior voices dominate decisions, team energy shifts from momentum to maintenance, and people lower their standards, choosing easier approaches rather than better ones. The most effective teams distinguish between speed (mere movement) and velocity (movement with direction), pausing to align on "What problem am I solving, and for whom?" before building anything.

UI AND UX DESIGN TRENDS FOR 2026: WHAT FOUNDERS AND DESIGNERS NEED TO KNOW

The digital design landscape in 2026 prioritizes outcome-driven UX where usability, accessibility, and measurable business results trump experimental aesthetics. Key shifts include UX teams proving tangible business impact, large conferences declining in favor of continuous internal learning, a return to familiar design conventions, regional trends influencing global design, and new platforms like Apple Vision Pro demanding new interface standards. AI integration has become indispensable in modern workflows, while visual design emphasizes cleaner, softer, more accessible interfaces with larger typography and thoughtful contrast.

STRIPE'S MINIATURE, MOTORISED CITY IS A MODEL MARVEL AND TRIBUTE TO THE HIDDEN WORLD OF COMMERCE

For Black Friday, Cyber Monday, and Giving Tuesday, Stripe created “Stripe City,” an eight-foot-wide miniature city with over 100 figures, motorised elements, and interactive live data displays, designed to visualise the complex flow of global commerce. Handcrafted from paper, foam, and acrylics, the city combines physical diorama charm with digital interactivity, offering a playful yet ambitious celebration of Stripe's infrastructure and the companies that rely on it, while livestreaming the experience for viewers during the busy financial weekend.

ADIDAS PURECHILL: THE SCULPTURAL SHOE REDEFINING RECOVERY

The Adidas Purechill Runner is a $75 recovery shoe featuring sculptural, single-piece EVA foam construction with 360-degree ventilation through grooved patterns and perforations.

GEN ALPHA IS ALREADY TRANSFORMING BRANDING

Gen Alpha is reshaping brand loyalty through participation rather than passive consumption.

LOGO ENDORSED BY KING CHARLES CAUGHT IN MESSY DESIGN DISPUTE

Severn & Wye Smokery faces complaints that its fly-fisherman logo may mislead customers into thinking its salmon is wild-caught, though the company insists labels clearly state it's farmed.

HOW TO WRITE A GREAT AGENTS.MD: LESSONS FROM OVER 2,500 REPOSITORIES

GitHub analyzed 2,500+ `agents.md` files and found the successful ones were specialists with clear jobs, not vague helpers. Good agents.md files give your agent specific commands to run, concrete code examples to follow, and explicit boundaries (like “never touch these files”). Start simple with one focused task like writing tests or docs, then iterate based on what breaks.

ON INHERITING AND SHARING PROPERTY VALUES

CSS doesn't let you set one property based on another's value (like `border-radius: height`), and there's no magic `compute()` function coming. Your best bets right now are to use CSS custom properties if you know the values, `aspect-ratio` to link width/height, `currentColor` to reuse colors, or container query units like `100cqh` to steal parent dimensions.

INTRODUCING AWS LAMBDA MANAGED INSTANCES: SERVERLESS SIMPLICITY WITH EC2 FLEXIBILITY

AWS Lambda Managed Instances is a new capability that can run AWS Lambda functions on Amazon Elastic Compute Cloud compute while maintaining serverless operational simplicity. It allows developers to access specialized compute options and optimize costs for steady-state workloads using a familiar serverless development experience. Lambda Managed Instances can be used to define how Lambda functions run on EC2 instances. Developers can just select compute profiles optimized for specific workload requirements without taking on the operational burden of managing Amazon EC2 infrastructure.

WHY USE REACT?

While React makes sense as a server-side authoring tool (developers love JSX and component architecture), shipping it to the browser hurts users with unnecessary JavaScript. Frameworks like Astro let you write in React but render plain HTML to users, while Next.js defaults to the “hydration” pattern that sends all that server-side JavaScript to the client anyway.

MY WEEKLY TECH INDUSTRY INTAKE ROUTINE AS A STAFF ENGINEER

A Staff Engineer shares his Saturday morning ritual for staying current: he batches all newsletters into a 2-3 hour block using Superhuman's split inbox (to separate articles from urgent emails) and Mailbrew (to group 60+ weekly emails into just 2 digests). His process is simple: queue interesting articles by title only, read them one by one, then immediately take action by either saving to Notion for reference or adding to Todoist as a work idea.

them the same way. Clerk's new Organization Growth Analytics

gives you retention, churn, and cohort analysis for every organization in your app. Daily, weekly, or monthly active orgs. Flexible filtering. Click any chart segment to drill into specific cohorts. Stop flying blind on B2B metrics.

AWS ANNOUNCES PREVIEW OF AWS INTERCONNECT - MULTICLOUD

AWS Interconnect - multicloud makes it easy to connect AWS networking services to other cloud service providers. It will start in preview with Google Cloud and then open up to Microsoft Azure later in 2026. The service is now available in preview in five AWS regions. Cloud service providers can easily adopt the service via a published open API package on GitHub.

RAD

Rad gives users Python-like scripting with CLI superpowers built in. It allows users to write maintainable scripts with declarative argument parsing, built-in JSON processing, and more. The project is still in early development, but it is already useful for real scripts. Rad is optimized for CLI scripting - a general-purpose language may be more appropriate for enterprise applications, high-performance computations, and projects that require specialized libraries.

AI AGENTS FIND $4.6M IN BLOCKCHAIN SMART CONTRACT EXPLOITS

Anthropic researchers evaluated AI agents' ability to exploit smart contracts on a newly created benchmark, SCONE-bench. The agents, including Claude Opus 4.5 and GPT-5, successfully exploited vulnerabilities in smart contracts, collectively amassing $4.6 million in simulated stolen funds from contracts exploited after March. In a separate simulation, the AI agents uncovered two novel zero-day vulnerabilities in recently deployed contracts, showing the technical feasibility of profitable, real-world autonomous exploitation.

THE PERFORMANCE INEQUALITY GAP, 2026

Despite devices and networks improving, the performance gap between rich and poor users is still growing. For 2026, the budget is ~150KiB of HTML/CSS/fonts and ~300-350KiB of JavaScript (gzipped) to serve the global 75th percentile, but less than half of mobile sites pass Core Web Vitals because developers keep shipping way more JavaScript than reasonable.

JOHN GIANNANDREA TO RETIRE FROM APPLE

Apple announced that John Giannandrea will retire as senior vice president for Machine Learning and AI Strategy, and Amar Subramanya (previously part of Microsoft and ex-VP of the Gemini App at Google) will join as the new vice president of AI.

GOOGLE UNKILLS JPEG XL?

After initially rejecting JPEG XL despite community support, Chromium has reversed its decision and will now support the format.

GOOGLE, NVIDIA, AND OPENAI

Google's advancements in AI with Gemini 3 and its TPU offerings are challenging the dominance of OpenAI and Nvidia, forcing them to re-evaluate their moats and strategies.

LAST WEEK ON MY MAC: LOSING CONFIDENCE

This dev has lost confidence in macOS due to silent failures, uninformative error messages, and the resulting reliance on workarounds.

PRIVILEGE ESCALATION WITH SAGEMAKER AND THERE'S MORE HIDING IN EXECUTION ROLES

Privilege escalation flaws have been discovered in AWS SageMaker. Attackers with specific permissions can inject malicious code via lifecycle configurations, mimicking EC2 user data escalation and affecting Lambda and CloudFormation. It is important to detect stop-modify-start sequences in CloudTrail and implement strict access controls.

TOP SOUTH KOREAN E-COMMERCE FIRM COUPANG APOLOGISES OVER MASSIVE DATA BREACH

South Korean e-commerce giant Coupang disclosed unauthorized access that affected 33.7 million customer accounts beginning June 24 through overseas servers, exposing names, email addresses, phone numbers, shipping addresses, and order histories. Authorities are investigating a suspected Chinese former employee. The government is examining potential personal information protection violations. This is the country's worst data breach in over a decade.

SMARTTUBE YOUTUBE APP FOR ANDROID TV BREACHED TO PUSH MALICIOUS UPDATE

The popular open-source SmartTube YouTube client for Android TV, which provides ad blocking and runs well on low-powered devices, was compromised after an attacker gained access to the developer's signing keys. The compromise was detected when multiple users reported that Play Protect blocked SmartTube. The app developer confirmed that his digital keys were compromised and stated that he had revoked the old signature and would publish a new version with a separate app ID.

BIND LINK – EDR TAMPERING

Threat actors can abuse Windows 11's Bind Link API through the bindflt.sys driver to redirect EDR installation folders to attacker-controlled directories, enabling DLL hijacking and code execution under EDR context. The EDR-Redir proof of concept uses LoadLibraryW to load bindfltapi.dll and CreateDirectoryW to create transparent folder mappings between virtual and backing paths. CrowdStrike, SentinelOne, and Carbon Black have implemented BindFlt monitoring, while Microsoft Defender for Endpoint remains vulnerable. Security teams should deploy Sysmon Event ID 7 monitoring for bindfltapi.dll image load events, validate whether legitimate bind link usage exists in their environment to reduce false positives, and investigate EDR vendor support for bindflt driver activity detection.

START USING WINDOWS AUTOPATCH

Microsoft Intune provides an endpoint management suite for Windows devices. Windows Autopatch is built into Intune and allows administrators to define groups to gradually roll out to an organization. Administrators can also configure hot patching on devices to expedite compliance.

SHAI HULUD 2.0: ANALYSIS AND COMMUNITY RESOURCES

Use code ZTWTLDR26 for $200 off your all-access pass

GUILTY-AS-YARA

Guilty-As-Yara is a Rust-based tool that generates Windows PE executables containing data patterns designed to trigger YARA rule matches for validating rules.

R2FRIDA

r2frida is a radare2 plugin that bundles Frida to instrument and analyze local or remote processes via r2 commands and scripts.

TOMIRIS SHIFTS TO PUBLIC-SERVICE IMPLANTS FOR STEALTHIER C2 IN ATTACKS ON GOVERNMENT TARGETS

Tomiris is a Kazakhstan-linked threat actor that leverages Telegram and Discord as command-and-control infrastructure while targeting foreign ministries and government entities across Russia and Central Asia through spear-phishing campaigns. The attack deploys multi-language malware, including Rust-based downloaders, Python-based backdoors like Distopia, and custom implants. Over 50% of lures use Russian-language content to blend malicious traffic with legitimate service activity. Security teams should monitor for unusual Telegram and Discord API traffic patterns, implement application control policies that restrict execution from archive files, and deploy behavioral detection to detect persistence mechanisms targeting Windows Registry modifications associated with these custom implant families.

AWS PRE:INVENT SECURITY HIGHLIGHTS: WHAT CHANGED AND WHY IT MATTERS

AWS has added a new CLI command, `aws login`, which allows users to obtain short-lived credentials for AWS even if the account isn't configured with IAM Identity Center. AWS IAM Outbound Identity Federation now allows AWS users or services to request a short-lived JWT for external services that trust your AWS account, which can replace the use of hardcoded, long-term credentials or API keys in Lambda or EC2. AWS has also enabled Attribute-Based Access Control (ABAC) for S3, which allows users to define access permissions to S3 using tags instead of listing every bucket in an IAM policy.

PURPLE TEAM MATURITY MODEL: FROM CHAOS TO CONTROLLED CHAOS

Organizations that wish to start with purple teaming can begin by defining a purple team strategy with loosely scheduled sessions, referencing MITRE ATT&CK tactics in testing, and feeding early detection gaps into detection engineering. Teams can then introduce metrics as they mature, begin using more structured purple team exercises, and map red team TTPs more closely to MITRE ATT&CK tactics and threat intel. As teams further mature, they can introduce automated adversary emulation. Eventually, purple teaming can be driven by threat-intel, continuously run fully automated attack chains, and integrate machine learning, SOAR, and XDR to power rapid detection and response.

now to get your 3 FREE INFOSEC SKILLS SEATS.

NORTH KOREAN HACKERS DEPLOY 197 NPM PACKAGES TO SPREAD UPDATED OTTERCOOKIE MALWARE

North Korean threat actors deployed 197 malicious npm packages downloaded over 31,000 times as part of the Contagious Interview campaign.

OVER 2,000 FAKE SHOPPING SITES SPOTTED BEFORE CYBER MONDAY

CloudSEK discovered over 2,000 interconnected fake shopping sites targeting Black Friday and Cyber Monday shoppers through coordinated phishing campaigns.