NVIDIA launched the Open Agent Safety Platform with OpenShell runtime controls and Sentry monitoring on BlueField-4 DPUs. OpenShell traces actions, applies policies, and supports NVIDIA, Arm, and Intel systems. Sentry verifies identity, inspects requests, protects data access, and can quarantine agents within milliseconds. Anthropic, Salesforce, SAP, Scale AI, and more than 100 organizations are integrating these controls.
tturl is an HTTP/2 CLI for finding tiny timing differences by releasing batches of requests and recording response arrival order, then either showing what happened or helping to distinguish a repeatable arrival-order signal from noise.
Proton Mail's web interface can show a forged sender that looks identical to a real one. The attacker sets a display name containing an address-shaped string like sundar@gmaiI[.]com where the capital I matches lowercase l in the default UI font. Messages from domains without DMARC arrive in the inbox with no authentication banner, even when SPF fails. A Reply-To header can route responses to an attacker's address without showing it unless the user expands headers, and the spoofed sender also appears unchanged in macOS desktop notifications, outside the app interface. The issue was reported in February 2025, confirmed and bounty-awarded in April 2025, and can still be reproduced as of September 2026.
Google and Wiz launched Scan for Good using Gemini 3.8 Flash Cyber and Red Agent with authorized scans targeting public websites, APIs, and applications, while human researchers validate findings and handle disclosure. Red Agent found a GitHub Actions injection flaw in Snowflake's connector, allowing command execution. Other cases exposed 8.8 million files, hospital systems, elderly residents' data, and railway administrator sessions.
This walkthrough breaks down House of Apple 2, a glibc FSOP technique that bypasses the vtable validation added in newer glibc. It points a FILE structure's vtable to legitimate wide-character stream code, which then dispatches to a second vtable that glibc does not range-check. Step by step in GDB, the author turns that unchecked indirect call into an arbitrary call, pivots the stack, and runs a ROP chain to a shell. The technique still works cleanly on glibc 2.43 (Ubuntu 26.04 and Fedora 44). Exact offsets and gadgets vary between builds, but the underlying control-flow trick remains the same.
The District of Columbia's health agency exposed data linked to 399,086 Medicaid and DC Healthcare Alliance beneficiaries.
Former Army soldier Cameron Wagenius received 70 months in prison and nearly $295,000 in restitution.
Sponsored
AI made building software easier, and now more of it is entering the enterprise than IT has ever had to govern. Keeping up takes new thinking on security, access, and oversight, built for software created faster and by more people than ever.
On October 6, join Tines and Forrester [4] for a candid conversation on why decision velocity is becoming IT's new differentiator, and what it means to govern outcomes rather than just oversee systems.
You'll learn how IT accountability is shifting from delivery to outcomes, and practical ways to position your team now for the next five years of AI-driven change.
2026.09.29·tines.com·Sponsor·TLDR IT UpGuard identified more than 16,000 Supabase databases exposing readable tables. Analysis of their schemas indicated that more than half could expose personal information, with smaller subsets potentially exposing passwords or authentication tokens. The issue is misconfigured access controls rather than a newly discovered platform vulnerability, reinforcing the need for database authorization, exposure testing, and clear ownership of internally built tools.
2026.09.29·links.tldrnewsletter.com·3 min read·TLDR IT Microsoft has paused optional update KB5002907 after reports that it left some Office 2016 and 2019 installations unlicensed or, rarely, removed. Its recovery guidance is to reactivate or reinstall the affected product. Importantly, the update makes no changes where Microsoft 365 Apps updates are managed through Group Policy or Cloud Update. Support teams should check update history before treating unexpected licensing tickets as subscription or account problems.
2026.09.29·links.tldrnewsletter.com·4 min read·TLDR IT Promoting a strong technologist does not automatically prepare them to manage people, business relationships, or competing operational priorities. This piece examines unclear expectations, insufficient leadership development, and the tendency to reward technical output without developing management skills. It is a useful operating-model check for CIOs overseeing support, infrastructure, SaaS, and business systems: define what managers own, coach them on business outcomes, and provide advancement paths for specialists who should remain individual contributors.
2026.09.29·cio.com·9 min read·TLDR IT In this Decoder interview, Mike Cannon-Brookes explains why Atlassian combined internal IT and AI enablement under its people leadership: employee adoption and changes to business systems are tightly connected. He also argues that AI will change SaaS workflows without eliminating the need for structured systems and human judgment. For CIOs, the interesting question is who owns the combined work of employee enablement, system integration, and AI cost management, rather than treating each as a separate rollout.
2026.09.29·theverge.com·40 min read·TLDR IT Anthropic's marketplace brings together more than 2,000 plugins and connectors, partner-built agents, and services, with eligible partner software purchasable using a portion of committed Anthropic spending. For an internal AI platform team, the significant change is the growing catalog of connections between assistants and business systems, along with another procurement channel to manage. Marketplace availability should not replace reviewing permissions, data access, integration ownership, and how access will be removed when someone leaves.
2026.09.29·links.tldrnewsletter.com·3 min read·TLDR IT Workday has announced Total Benefits, combining benefits-provider integrations, administration services, and employee guidance in one offering. Workday Wellness is now available to US customers, while benefits guidance through its Self-Service Agent is expected to become generally available in October. Evaluation should cover provider compatibility, sensitive employee-data sharing, and whether the new workflows can replace existing portals and manual administration rather than simply adding another layer.
2026.09.29·newsroom.workday.com·5 min read·TLDR IT Disabling BitLocker starts decrypting the drive, while suspending protection leaves the data encrypted but temporarily makes the encryption key accessible. This walkthrough explains the distinction and why short-term firmware maintenance or troubleshooting often calls for suspension rather than removing encryption entirely. The operational takeaway is to make resuming and verifying protection part of the endpoint maintenance runbook, not optional cleanup after the support ticket closes.
2026.09.29·petri.com·6 min read·TLDR IT Microsoft 365 customers can now use consumption-based billing when users exceed their licensed OneDrive storage instead of purchasing additional capacity upfront. Admins choose which users are eligible and can set budgets and alerts. Additional storage costs $0.20/GB/month. Enterprise SaaS is shifting toward usage-based pricing, giving IT more flexibility but also making cost monitoring part of day-to-day platform management.
2026.09.29·computerworld.com·2 min read·TLDR IT Google will begin applying new automatic-note settings on September 29.
2026.09.29·workspaceupdates.googleblog.com·3 min read·TLDR IT Cloudflare says it completed remediation of a cross-tenant storage-reuse flaw affecting Containers and Sandboxes by September 19, found no evidence of malicious exploitation in available telemetry, and requires no customer-side action.
2026.09.29·links.tldrnewsletter.com·3 min read·TLDR IT Sponsored
96% of brands struggle to execute personalization at scale. Corinthia Hotels is not one of them.
They built a 7-agent AI system on Optimizely that maps 76 behavioral signals to 6,384 content variants across 5 personas and 14 lifecycle stages. 100% brand approval rate. 150+ hours saved. Zero PII in the AI layer. Zero extra headcount.
On October 7th [5], Emily Jewell, Senior Global Head of Marketing at Corinthia Hotels, walks you through the full system live — including two demos and a Q&A exclusive to attendees.
AI is splitting physical retail into two distinct missions. Convenience stores should reduce friction with easy navigation and reactive service. Discovery stores should drive dwell time through immersive experiences and specialized associates. More than 90% of consumers prioritize locations that fit their daily routines, while 78% cite product testing and 76% cite product guidance as drivers of discovery visits.
AI confidence is growing across the workforce, with 53% of US workers saying AI makes them more efficient. Gen Z remains more hesitant. Only 38% plan to build AI skills in the next 6 months, while 52% are nervous about AI's impact on their jobs. At the same time, AI literacy is becoming more valuable in the workplace. LinkedIn finds it is associated with stronger hiring and promotion outcomes for Gen Z.
FAQs can improve visibility in search and AI systems only if the content is present in the page source when it loads. Many FAQ components hide their text until a user clicks to expand them, which means search engines and LLMs may not access the content by default. Use Chrome DevTools to check whether FAQ text remains discoverable after a page reload.
Treat YouTube descriptions like landing pages for AI search. ChatGPT can retrieve a video's title, metadata, and full description, but not its transcript. That makes the description a key source for understanding the video. Include relevant terms and clear context. Use structured sections and timecodes so ChatGPT can understand what the video covers and where specific topics appear.
AEO is not an SEO ranking game with factors to reverse engineer. AI visibility depends on whether a brand is clearly associated with a category and supported by credible evidence. Fix positioning gaps and answer real buyer questions. Build comparison content that helps buyers evaluate vendors. Strengthen third-party corroboration instead of manufacturing mentions. Then track commercial prompts and connect AI visibility to buyer conversations and pipeline, not just brand mentions.
Sponsored
Gather builds a simulation of your customers from real interviews. Run strategy simulation, test messaging, positioning, pricing, explore why buyers choose competitors, and get insights instantly.
Trusted by Datadog, Fortinet, Cyera, Bagel Brands, Staples, and others.
XML sitemaps tell search engines which URLs a site wants in search results. They should contain canonical, working URLs that the site wants indexed. Google attempts to crawl each URL as listed, so redirects, errors, noindex pages, or conflicting canonicals make the sitemap less useful and can waste crawl activity. Missing or repeated ‘lastmod' dates can be acceptable. Fields like ‘priority' and ‘changefreq' are ignored by Google.
Reddit is often treated as a source of unbiased product advice. However, some buying recommendations are unusually concentrated among a small group of accounts. The top 5% of brand-heavy accounts produced 11.3% of knife recommendations, versus 7.9% expected by chance. For three brands, that share reached 20% to 31%. This could indicate astroturfing, where paid accounts create the appearance of organic recommendations, but their histories looked more like genuine fans.
AI is making click-based attribution less useful as discovery increasingly happens through AI answers that never generate a website visit. Treat attribution as one imperfect signal rather than a definitive measure of channel value. Triangulate exposure, behavioral, and business metrics such as AI Share of Voice and CRM data. Use incrementality testing where possible to measure causal impact, especially for activities that attribution cannot capture.
Canva is using Jio's 524.4M customers to tackle a freemium problem. Many casual users get enough value from Free to justify paying for Pro. Bundling Pro with Jio plans lets users experience premium features without making a separate purchase. The real test is what happens after the bundle ends. Canva needs to see whether users build habits around Pro and become willing to pay for it.
Wendy's dropped a full emo EP for late-night food runs.
Use identity-based emails to re-engage churned customers and dead leads.
Sponsored
Commercial payments, stablecoin backed cards and money movement — every new capability rides on the infrastructure beneath it. And that infrastructure has to hold up.
Marqeta gives the world's most innovative companies a modern card issuing platform built to scale globally, adapt fast, and stay dependable as your ambitions grow, with seamless API integration, multi-currency support, real-time fraud detection, and the reliability high-volume programs depend on.
Current AI tools often act as misleading software. Serious AI products must feature error checking, robust citations, no first-person language, and non-natural language interfaces when appropriate.
AI is pushing leaders back into hands-on work, but that shift may be temporary. As building gets cheaper, expert leadership becomes more important.
Organizations fail to deploy enterprise AI agents because they treat them like software rollouts rather than new hires needing onboarding and data prep. Clean data, workflow integration, and governance present far greater bottlenecks than model performance.
Google's search quality failures stem from product and organizational flaws rather than model limitations. By layering probabilistic AI features onto a deterministic search interface without updating UI promises or user feedback loops, companies risk eroding user trust through unverified AI outputs.
Sponsored
Pendo's Learning Lab has practical courses on AI agents, product judgment, and becoming AI-native. All courses are self-paced, free, and you'll finish with a badge worth sharing on LinkedIn. Explore the
The AI building boom risks producing generic "zombie UI" if teams ignore intent and artistry. To counter this, teams must maintain a strong design POV, encode standards into production, refuse to settle for standard builds, and invent new interfaces with AI.
B2B AI vendors should publish deep, direct, and continuous competitive evaluations against named competitors to build buyer trust, as demonstrated by Gorgias open-sourcing a live evaluation harness across 18 vendors.
Traditional chat interfaces like Slack create an information bottleneck. It's essential to establish a shared context system to maintain aligned results and prevent compounding divergences when multiple users and AI agents collaborate.
Software accrues long-term value by creating dependencies that compound over time and increase switching costs. This process involves dependency formation across multiple categories, internal and external compounding such as network effects, and critical workflow multipliers that dictate overall switching risk and revenue capture.
Sponsored
Align strategy to work, human and agent, in one system. Connect data and flag drift. Learn more [15].
Delegating to AI leaves cognitive load and accountability with the user.
Axiom has added a feedback tool to its MCP server that enables AI agents to directly report roadblocks during workflows.
Sponsored
Paid search and social weren't delivering for ThreatSpike. After testing TLDR, the cybersecurity company found one of its most efficient channels, bringing in inquiries from buyers with real purchase intent. See how ThreatSpike turns newsletter ads into pipeline [4].
2026.09.28·advertise.tldr.tech·Sponsor·TLDR