Search the archive

FIGR AI

Figr is an AI product design agent for UX analysis and prototyping.

NAVIGATING A PARADIGM SHIFT

The hardest part of a paradigm shift is navigating it while it's incomplete. Paradigm shifts are tectonic shifts beneath markets, technologies, and human thought. They begin quietly at first, then the world suddenly bends. Paradigm shifts begin with dissonance, not consensus, as the old ways no longer fit the new reality. The best founders understand why the current system works, but believe there are better ways to do things.

A PRIMER ON FACTORY ECONOMICS FOR STARTUPS

Tesla popularized the "factory-is-the-product" thesis. It now applies to companies making drone motors, robot actuators, PCBs, and battery packs. The learning curve is central to strategy: for each doubling of cumulative production, costs fall predictably. Your competitive position depends on where you are on the curve, how fast you descend, and whether you can finance the journey.

THE DARK SIDE OF BUILDING IN PUBLIC

Building in public means the criticism is public too.

ZERO TO ONE IS A SUBTRACTION PROBLEM

Zero to one involves strategic choices about what features and design to prioritize, impacting a startup's early growth and learning.

HIGH-FREQUENCY SOFTWARE

Software engineering will turn to focus on coding the 'machine that builds the machine' over the next five to ten years.

START A FREE INSIGHTS 14-DAY TRIAL TO GET UNIFIED VISIBILITY ACROSS EVERY CLOUD. →

HOW I "HACKED" CHATGPT ATLAS... AND WHY IT WASN'T PATCHED

A researcher discovered that ChatGPT Atlas's OWL architecture allows local attackers to replace the headless Chromium "OWL Host" with a malicious app, inheriting Atlas's macOS TCC privileges to silently access the microphone, camera, or other permissions previously granted by the user. OpenAI declined to patch the bug, citing Chrome's threat model, which excludes local attacks—a stance inherited downstream by Electron and Chromium forks that the researcher argues leaves macOS users fundamentally less secure. The unpatched vulnerability highlights a growing tension between Chrome's threat-model assumptions and macOS's TCC permission system, in which confused deputy attacks can bypass OS-level consent controls without user awareness.

INDIAN PHARMACY CHAIN GIANT EXPOSED CUSTOMER DATA AND INTERNAL SYSTEMS

A misconfigured “super admin” interface at DavaIndia Pharmacy, part of Zota Healthcare, allowed anyone to create high-privilege accounts and access data on nearly 17,000 online orders across 883 stores, including names, contacts, addresses, and purchased medicines. Attackers could have altered pricing, discounts, and prescription requirements before the flaw, reported to CERT-In in August 2025, was quietly fixed.

HOW A SINGLE TYPO LED TO RCE IN FIREFOX

A single-character typo (using `&` instead of `|`) in a SpiderMonkey Wasm GC array refactoring commit introduced a use-after-free vulnerability in Firefox's renderer process, enabling arbitrary read/write primitives and full code execution. The bug caused out-of-line array forwarding pointers to be incorrectly zeroed during garbage collection, allowing attackers to reclaim freed memory via heap spraying, bypass ASLR through pointer leaks, and hijack control flow. The vulnerability affected only Firefox 149 Nightly and was patched within six days of the report. No release versions were affected.

INSIDE BASHE: THE INTERVIEW WITH THE RANSOMWARE GROUP KNOWN AS APT73

Bashe (formerly APT73) is a RaaS group rebranded around a Chinese mythological serpent identity. It operates with a 0.25 BTC affiliate entry fee as both a monetization and anti-infiltration measure, and collaborates with initial access brokers and disgruntled corporate insiders. The group claims full-stack encryption, EDR bypass capabilities, and centralized control over negotiation panels and data publication timers, while excluding healthcare, schools, and CIS countries from targeting. This pattern is consistent with norms in the Russian-speaking ransomware ecosystem. Their deliberate vagueness on technical specifics such as key management architecture, combined with profit-first rhetoric and a shifting geographic focus toward countries with higher payment rates, provides useful threat intelligence for defenders modeling RaaS operator behavior.

BREAKING EBPF SECURITY: HOW KERNEL ROOTKITS BLIND OBSERVABILITY TOOLS

Research has shown that kernel rootkits can systematically blind eBPF-based security tools by using ftrace to hook the data-delivery plumbing, BPF iterators, ring buffers, perf events, and map operations, rather than targeting the eBPF programs themselves. The Singularity rootkit selectively filters hidden processes and network connections at the kernel-to-userspace boundary, causing security tools to operate on a fabricated view of system state while believing they have complete visibility. The findings underscore that eBPF observability assumes a trusted kernel, and defenders must prioritize preventing kernel compromise through Secure Boot, signed module enforcement, and layered out-of-host detection rather than relying solely on kernel-level telemetry.

A STANDARDIZATION GUIDE TO PROMPT INJECTION

Lasso proposes a structured taxonomy for prompt injection, distinguishing between attacker intent (system prompt leakage vs. jailbreak) and text-based techniques, including instruction override, role-playing, and others. Each category includes concrete subtypes and examples to help practitioners more reliably detect, reason about, and defend against modern LLM prompt attacks.

secure your apps with Azure >

LAZYDLLSIDELOAD

LazyDLLSideload is a Rust-based tool for generating DLL proxy and sideload projects for red team engagements, automatically parsing PE export tables and producing ready-to-compile implants with payload embedding, string obfuscation, and dynamic invocation via dyncvoke. It supports two modes: sideload (pure DLL replacement with stub exports) and proxy (forwarding calls to the renamed original DLL while intercepting a specified function), with optional native syscall execution via NtCreateThreadEx for improved OPSEC.

PWNHUB

Hand‑curated offensive security toolkit, scripts, and writeups for ethical hackers, pentesters, and IT pros eager to level up.

VULNCHECK (PRODUCT LAUNCH)

VulnCheck provides a vulnerability intelligence platform that tracks vulnerability lifecycles and active exploitation, monitoring exploit code and payloads so security teams can identify, prioritize, and patch the CVEs that pose the most immediate, real-world risk.

SECURING DIGITAL ASSETS IN AN EVOLVING THREAT LANDSCAPE: THE FIREBLOCKS DEFENSE-IN-DEPTH APPROACH TO SECURITY

HACKERS OFFER TO SELL MILLIONS OF EURAIL USER RECORDS

Hackers claim to have stolen 1.3 TB of data from Eurail's AWS S3, Zendesk, and GitLab, including source code, support tickets, and database backups with personal data on potentially millions of Eurail and Interrail customers. Exposed fields range from contact and passport details to health and bank data for DiscoverEU travelers.

INFOSTEALER STEALS OPENCLAW AI AGENT CONFIGURATION FILES AND GATEWAY TOKENS

An infostealer, likely a Vidar variant, exfiltrated OpenClaw config files containing gateway tokens, device keys, and an AI agent “soul,” enabling remote access and identity hijacking. Meanwhile, malicious ClawHub skills, exposed OpenClaw instances with RCE potential, and persistent Moltbook accounts are growing attacker interest as OpenClaw's ecosystem rapidly scales.

MICROSOFT ALERTS ON DNS-BASED CLICKFIX VARIANT DELIVERING MALWARE VIA NSLOOKUP

There is a new ClickFix variant that uses nslookup commands via the Windows Run dialog to retrieve and execute second-stage payloads through DNS, ultimately deploying the Python-based ModeloRAT remote access trojan.

CISA GIVES FEDS 3 DAYS TO PATCH ACTIVELY EXPLOITED BEYONDTRUST FLAW

CISA added BeyondTrust's actively exploited OS command-injection flaw (CVE-2026-1731) to its KEV catalog, ordering federal agencies to patch Remote Support and Privileged Remote Access instances by February 16, as approximately 8,500 on-premises deployments remain exposed.

SPAIN ORDERS NORDVPN AND PROTONVPN TO BLOCK LALIGA STREAM PIRACY

A Spanish court ordered NordVPN and ProtonVPN to block 16 piracy websites under the EU Digital Services Regulation, with both providers contesting the ruling as procedurally invalid since neither was notified or given the opportunity to defend themselves.

📅 Join live on February 25 at 10am EST

🎁 Get access to a special offer on WiseStamp's leading email signature management platform when you register!

NEW DATA SHOWS #AD ON INFLUENCER CONTENT DOES NOT HARM ENGAGEMENT

Research shows that explicit ad disclosure on influencer content does not harm engagement on Instagram. In many cases, it actually improves performance. Posts with #AD generate higher median likes and comments across all UK influencer tiers. For creators with over 500K followers, disclosure acts as a credibility and legitimacy signal rather than limiting reach. The findings debunk the belief that platforms downrank sponsored content.

SNAPCHAT LAUNCHES CREATOR SUBSCRIPTIONS

Snapchat is launching Creator Subscriptions to give creators recurring income and give fans paid access to exclusive content and ad-free Stories. The program will start on February 23 in alpha testing with select US creators and then expand to Canada, the UK, and France. Subscribers get exclusive Snaps and Stories, priority replies, and no ads in that creator's Stories. Creators can set their own monthly prices within recommended tiers. Early participating creators include Jeremiah Brown, Harry Jowsey, and Skai Jackson.

THE NEXT UGC: CONTENT LOYALTY PROGRAMS

Content loyalty programs reward customers for posting social content. They are becoming a new way for brands to drive user-generated content and demand. 92% of consumers trust user-generated content over ads. Brands can use CRM portals to collect posts and give points, perks, and exclusive access in return. A program built by Ogilvy for Nestlé in Vietnam for the Milo brand signed up 2,600 creators, produced 3,100 submissions, and reached 78 million video views.

WIN REPORT: HOW REMOVING FRICTION INCREASED PAID SUBSCRIPTIONS BY 13%

Mobbin increased paid subscriptions by 13% after it replaced a static paywall banner with a sticky header that kept the ‘Get Pro' call-to-action visible during scrolling. User testing showed that free users often scrolled far down the page and lost sight of the paywall prompt at the moment they were ready to subscribe. The variation kept the banner fixed at the top, updated the asset count to show full Pro value, and added social proof that said it supports over 1M designers. The test shows that reducing decision friction and keeping contextual CTAs visible can lift conversions.

THE DEFINITIVE GUIDE TO QUESTION MINING

Question mining is the practice of systematically finding and prioritizing the real questions that shape buying decisions. It focuses especially on the ones rooted in uncertainty rather than simple curiosity. Visibility today depends less on ranking pages and more on whose explanations get synthesized and reused. Teams need a continuous system that captures questions from sales, reviews, and search, filters for decision impact, and turns them into canonical answers. The goal is to consistently reduce ambiguity so your explanation becomes the default reference across AI, search, and sales conversations.

THE SUBSTACK PRINT

This tool turns any Substack into a printable newspaper.

NEW FEATURE IN LINKEDIN CAMPAIGN MANAGER

LinkedIn Campaign Manager now lets advertisers benchmark performance beyond simple period comparisons with 2 new views. Industry benchmark compares ad sets to similar advertisers over the past 90 days, while self benchmark compares similar ad sets within the same account over the same period. This upgrade provides context that month-over-month changes and generic averages could not, revealing whether performance is truly under or above the market. The feature is still rolling out to all accounts.

DON'T OVERESTIMATE YOUR CUSTOMERS' SATISFACTION

Managers often misjudge how satisfied their customers are and misunderstand what drives that satisfaction. Research across 70,000 customer surveys and 1,068 manager responses showed managers overestimated satisfaction by 4.1%, repurchase intent by 4.9%, and customer expectations by about 3% to 4%, while underestimating complaints by 30%. It also found that managers undervalued the role of product quality for both satisfaction and perceived value, and misjudged how satisfaction reduces complaints. Bias and internal optimism often distort how leaders read customer data, which leads to poor decisions about retention and experience. Companies like Loom show that better survey design and more personal outreach can lift spending by up to 32.9% and reduce churn.

WHY EVERYONE PROMPTS AI DIFFERENTLY (EVEN WHEN THEY WANT THE SAME THING)

A small experiment showed that even people with the same goal write very different AI prompts. Larger research confirms that prompts sharing the same intent rarely look alike. People add context, constraints, and personal nuance instead of reducing the need to tidy keywords. Despite wide variation in wording, AI systems often detect the underlying intent and return similar recommendations. The key is to focus less on specific prompts and more on understanding how people naturally describe their problems. Then create content that reflects that language across the web.

THE PATH TO PURCHASE JUST GOT DRAMATICALLY SHORTER

Holiday data shows the funnel compressing as more purchases occur at or near first exposure. Retail sales rose 4.1% year over year from Thanksgiving through Cyber Monday, with ecommerce up 10.4%, despite economic pressure. Platforms like Facebook and Instagram are capturing more budget because discovery and checkout happen in one environment, enabling immediate conversion. Brands are seeing stronger performance from upper funnel media as targeting improves and standardized checkout reduces friction.

EMAIL METRICS THAT MATTER: WHAT TO MEASURE IN 2026

A list of email metrics categorized by business impact, engagement, deliverability, and reputation.

META LAUNCHES MANUS AI INTEGRATION IN ADS MANAGER

Meta Platforms has integrated Manus AI into Ads Manager to give advertisers built-in AI agents for reports and audience research.

Get the Cheat Sheet

SPACEX TO COMPETE IN PENTAGON CONTEST FOR AUTONOMOUS DRONE TECH

SpaceX and its wholly owned subsidiary, xAI, are competing in a secretive new Pentagon contract to produce voice-controlled autonomous drone swarming technology. While Elon Musk has been enthusiastic about advancing AI, he has previously argued for a ban on autonomous weapons that can select and engage their own targets and operate beyond meaningful human control. OpenAI is also working on the effort by supporting a successful submission from Applied Intuition. The company's contribution to the project will be limited solely to the conversion of voice and other instructions from battlefield commanders into digital instructions. Its technology won't be used for the operation of the drone swarm, weapons integration, or target authority.

APPLE TAKES ON YOUTUBE AND SPOTIFY WITH NEW VIDEO PODCASTING PUSH

Apple will be introducing an integrated video podcast experience to Apple Podcasts in the spring. The update will bring Apple Podcasts more in line with its competitors, which have increasingly leaned into video podcasting. There will be a picture-in-picture mode, and users will be able to download video episodes for offline viewing. The update will introduce support for HTTP Live Streaming, which features dynamic video ad insertion.

BCIS IN 2026: STILL JANKY, STILL DANGEROUS, STILL OVERHYPED

The fundamental problems that plagued Brain-Computer Interfaces (BCIs) a decade ago are still here. While there is genuine, impactful progress in BCIs, this remains largely confined to severe medical conditions. These are highly specialized, medically critical applications, and there are severe engineering challenges that must be overcome before they can be extrapolated into consumer products. This article takes a look at the state of the BCI industry to provide a realistic look at where the technology currently stands and the path forward.

RARE, DANGEROUS SIDE EFFECTS OF SOME COVID-19 VACCINES EXPLAINED

Vaccine-induced immune thrombocytopenia and thrombosis (VITT) occurred in roughly one out of 200,000 people who received adenovirus-based COVID-19 vaccines. The condition occurred due to PF4 antibodies binding to rogue antibodies, setting off a dangerous cascade (PF4 is a protein involved in blood clotting). Researchers hypothesize that patients who developed VITT had previously been infected with an adenovirus, which primed their B cells to recognize an adenovirus protein in the vaccine, which kicked those cells into action, starting a mutation-generating process that produced a variant with a negatively charged amino acid, which ultimately led to VITT. In most parts of the world, between 40% and 60% of the population has the genetic background that makes people more prone to VITT, but in East Asia, the prevalence is only 20%.

went down during the big launch. Build without limits with Azure

ANTHROPIC TRIES TO HIDE CLAUDE'S AI ACTIONS. DEVS HATE IT

Anthropic has changed Claude Code's progress output to hide the names of files the tool was reading, writing, or editing. Developers have pushed back, saying they need to see which files were accessed. The full details can still be accessed with a keyboard shortcut. Developers who want more details can also enable verbose mode.

DANGEROUSLY-SKIP-READING-CODE

Large language models generate code much faster than humans can read it. We can't expect humans to effectively review, understand, and approve every diff anymore. Humans should focus their efforts on specifications and tests while agents code. Rework is almost free, so there should be less effort put into preventing incorrect work from happening.