Search the archive

COLE PALMER'S NEW LOGO HAS A GENIUS DOUBLE MEANING

Footballer Cole Palmer has unveiled a minimalist new logo that interlocks his initials to mimic his iconic crossed-arms “Ice Man” celebration.

TRY GREPTILE FREE FOR 14 DAYS

HOW X DECIDES WHAT 550 MILLION USERS SEE

X's feed algorithm, which determines what 550 million users see through a component-based pipeline, was recently open-sourced. The pipeline has sources like Thunder (for in-network posts) and Phoenix (for discovery), which feed candidates into a system of hydrators, filters, and multi-stage scorers. Posts are evaluated based on eighteen predicted engagement probabilities, weighted, and adjusted for author diversity and whether they are from followed accounts.

WE FIXED A 6-YEAR-OLD JAVASCRIPT MEMORY LEAK

DebugBear fixed a 6-year-old memory leak in its Google Cloud Functions caused by lodash's `memoize` caching all data indefinitely without clearing it. The leak only showed up with thousands of unique URLs in production, not in local testing with repeated URLs, so the company just lived with occasional crashes and auto-retries.

THE 80% PROBLEM IN AGENTIC CODING

Many engineers now use AI agents to write 80-100% of their code, transforming their role from direct implementers to orchestrators. This adoption has introduced new problems, such as conceptual AI errors, comprehension debt within codebases, and a productivity paradox where review times balloon. Engineers need to shift to a declarative approach, focusing on problem definition and architectural oversight.

DON'T SOLVE PROBLEMS THAT DON'T EXIST

People frequently waste time solving problems that don't exist, driven by procrastination, unclear next steps, and a subconscious avoidance of discomfort. This tendency is made worse by Parkinson's Law and an aversion to high-uncertainty tasks.

THE NEW ERA OF BROWSING: PUTTING GEMINI TO WORK IN CHROME

Google is integrating major Gemini AI updates into Chrome, including a new side panel for multitasking across tabs and deeper integrations with other Google apps like Gmail and Calendar. For AI Pro and Ultra subscribers, Chrome now has "auto browse," an agentic feature that automatically browses the web to handle complex multi-step tasks such as vacation planning, online forms, and smart shopping.

INTRODUCING LIBPDF: THE PDF LIBRARY TYPESCRIPT DESERVES

LibPDF is a new TypeScript-first document parsing library that supports lenient parsing, native digital signature support (eliminating complex workarounds like Rust bindings), and incremental saves vital for multi-party signing workflows.

INTRODUCING RELICSS: A TOOL FOR FRONT-END ARCHAEOLOGY

ReliCSS is a browser-based tool designed to scan CSS and identify "browser hacks" and historical artifacts. It parses CSS, highlights these findings with severity levels, and suggests ways to modernize or remove them.

SUSPICIOUSLY PRECISE FLOATS, OR, HOW I GOT CLAUDE'S REAL LIMITS

This dev reverse-engineered Claude's hidden usage limits and internal credit system by analyzing unrounded float values from the API. Findings show the 5x subscription plan has amazing value, providing much more usage (up to 8 times weekly) than advertised, while the 20x plan is less efficient for weekly tasks. Subscription plans are always superior to API pricing, mainly due to free cache reads and discounted cache writes.

ADDING DYNAMIC FEATURES TO AN AGGRESSIVELY CACHED WEBSITE

This dev implemented dynamic features on his aggressively cached website, which uses Cloudflare with a 15-minute cache header. He used localStorage and client-side JavaScript for features that bypass full-page caching. Examples include "Edit" links visible only to the administrator based on a `localStorage` key, and a "Random" button for navigating posts within a specific tag.

AMAZON AXES 16,000 JOBS AS IT PUSHES AI AND EFFICIENCY

Amazon has confirmed 16,000 corporate job cuts, completing a plan for approximately 30,000 total reductions, as it streamlines operations, shuts down underperforming businesses, and embraces AI.

INTRODUCING LM STUDIO 0.4.0

LM Studio 0.4, used to run AI locally on your computer, introduces a server-native daemon for headless deployment, parallel inference for high throughput, a new stateful REST API, and a refreshed user interface.

A VERIFICATION LAYER FOR BROWSER AGENTS: AMAZON CASE STUDY

Small local AI models are viable for executing browser tasks by using structured snapshots and explicit assertions as a verification layer.

FROM MICROSOFT TO MICROSLOP TO LINUX: WHY I MADE THE SWITCH

A long-time Windows user made a reluctant but ultimately successful switch to Linux due to Windows adding more ads and bugs into the user experience.

SIX JAVASCRIPT ZERO-DAY BUGS LEAD TO FEARS OF SUPPLY CHAIN ATTACK

Researchers from Koi discovered six zero-day vulnerabilities dubbed "PackageGate" across four major JavaScript package managers (npm, pnpm, vlt, and Bun) that bypass protections against script execution and lockfile integrity designed to prevent malicious code from running automatically. While pnpm, vlt, and Bun patched the flaws, npm (now owned by Microsoft) declined to fix the vulnerabilities, stating that the behavior "works as expected," leaving gaps in defenses adopted after the Shai-Hulud supply chain attack that affected over 25,000 repositories. The bypasses vary by tool—npm's weakness lies in Git dependencies with malicious .npmrc files, pnpm and vlt have lockfile gaps enabling tarball swapping, vlt has a tar extraction path traversal flaw, and Bun's trust allowlist can be spoofed—raising concerns about potential install-time code execution at scale even in hardened environments.

CRITICAL GRIST-CORE VULNERABILITY ALLOWS RCE ATTACKS VIA SPREADSHEET FORMULAS

CVE-2026-24002 (CVSS 9.1) is a critical Pyodide sandbox escape vulnerability dubbed "Cellbreak" in Grist-Core that allows attackers to execute arbitrary OS commands or host-runtime JavaScript through malicious spreadsheet formulas. The flaw stems from Grist's blocklist-style sandbox approach that permits traversal through Python's class hierarchy and leaves ctypes available, enabling attackers to access database credentials, API keys, and sensitive files while creating lateral movement opportunities. The vulnerability was patched in version 1.7.9, released January 9, with users advised to update immediately or temporarily mitigate by setting GRIST_SANDBOX_FLAVOR to "gvisor," while avoiding the GRIST_PYODIDE_SKIP_DENO flag that reintroduces the risk.

NEW SANDBOX ESCAPE FLAW EXPOSES N8N INSTANCES TO RCE ATTACKS

Researchers from JFrog discovered two new vulnerabilities in the n8n workflow automation platform that could allow for RCE, one of which received a CVSS score of 9.9. The two vulnerabilities are AST sandbox escapes in both Python and JavaScript sandboxes that could allow for arbitrary code execution on the underlying nodes. The vulnerability has been fixed in the n8n cloud platform, but users running self-hosted versions should update to fix it.

THE EVOLUTION OF FIDO EXPERIENCES ON ANDROID

Google detailed Android's evolution from password-based authentication to FIDO2 passkeys, starting with Universal Second Factor (U2F) in 2014 as a phishing-resistant second factor and advancing to passwordless passkeys built on WebAuthn and CTAP2 standards that use device biometrics, PINs, or patterns for authentication. Android announced FIDO2 specifications over USB with PIN support in November 2023, featuring streamlined user experiences with Material3 Design bottomsheets, Credential Manager APIs for easier developer integration, and secure PIN protocol algorithms that avoid storing actual PINs on devices or security keys. Google plans continued FIDO enhancements, including NFC support, native credential management for physical security keys, and post-quantum cryptographic algorithms to ensure passkey security remains robust against emerging threats like quantum computers.

ON THE COMING INDUSTRIALIZATION OF EXPLOIT GENERATION WITH LLMS

The author of this post discovered a novel zero-day in QuickJS using Opus 4.5 and GPT-5.2. They set up a testbed in which the agents were tasked with achieving different objectives across systems with varying protections. The author succeeded in generating over 40 distinct exploits, including complex exploit chains. Experiments such as this demonstrate that tasks like exploit generation are increasingly solvable by LLMs with enough tokens.

GENERAL GRABOIDS: WORMS AND REMOTE CODE EXECUTION IN COMMAND & CONQUER

Security researchers analyzed Command & Conquer: Generals' newly released source code and uncovered three major multiplayer flaws: a filename stack overflow, arbitrary file writes, and an out-of-bounds write during packet fragmentation. By chaining these bugs, they achieved reliable remote code execution, then built a self-spreading worm that drops a malicious DLL, hooks legacy Windows socket APIs, listens for “magic” packets or chat messages, executes OS commands, and manipulates local game actions such as camera and UI effects.

INTRODUCING IDE-SHEPHERD: YOUR SHIELD AGAINST THREAT ACTORS LURKING IN YOUR IDE

IDE-SHEPHERD is a free open-source security extension for VS Code and Cursor that addresses trust-based security model vulnerabilities by integrating into the Node.js runtime of the extension host process. The tool uses a require-in-the-middle layer to patch critical modules like child_process, http, and https, enabling real-time interception and blocking of malicious operations, including process execution, network communications, and workspace task execution against a growing ruleset. IDE-SHEPHERD provides granular per-extension behavior analysis rather than publisher-based trust, includes heuristic detection for suspicious extension metadata (wildcard activations, obfuscation, and missing repository links), and offers optional Datadog Agent integration for centralized monitoring while keeping all data local by default.

A FIRST LOOK AT APERTURE BY TAILSCALE (PRIVATE ALPHA)

Aperture is an alpha-stage AI gateway that offers insights into coding agent usage within organizations. It eliminates the need to share API keys by using Tailscale's built-in identity system for authenticating users and machines. The tool supports CLI and VS Code-based AI coding agents such as Claude Code, Codex, and Gemini CLI, providing centralized monitoring of usage, cost tracking across different models and providers, and SIEM integration via S3 exports, all while linking API usage to specific users and devices. Aperture is free for up to three users, similar to Tailscale's Personal plan. It features an extensible platform, starting with a partnership with Oso to enhance security controls, alerts, and audits, with future plans to extend beyond coding agents to other AI workloads.

DUMPBROWSERSECRETS

DumpBrowserSecrets is an improved version of the DumpChromeSecrets program that can extract browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers.

VIBE-CODED 'SICARII' RANSOMWARE CAN'T BE DECRYPTED

The Sicarii ransomware, which emerged as a RaaS offering in December, contains a critical design flaw that makes decryption impossible even if victims pay, as the malware regenerates new RSA key pairs locally during each execution and discards the private key needed for recovery. The ransomware's suspicious "Israeli/Jewish" branding with Hebrew language and historical symbols appears to be a false flag, given its primarily Russian-language operations and machine-translated Hebrew content with errors. It was likely that inexperienced developers used AI-assisted tooling to create the poorly coded ransomware. Organizations affected are advised to abandon ransom negotiations and focus on alternate recovery pathways, including backups and incident response services.

TRUMP'S ACTING CYBERSECURITY CHIEF UPLOADED SENSITIVE GOVERNMENT DOCS TO CHATGPT

Acting CISA director Madhu Gottumukkala, a Trump appointee, uploaded internal “for official use only” contracting documents to ChatGPT, triggering federal security alerts and a DHS review of potential damage. Officials had previously granted him a special exemption to use ChatGPT, even as other staff were barred. His tenure has already been controversial after an unsanctioned polygraph and suspensions of career staff.

THERE'S A RASH OF SCAM SPAM COMING FROM A REAL MICROSOFT ADDRESS

A legitimate Microsoft Power BI email address is being abused to send fake $399 billing alerts that push victims to call a number and install remote-access tools, handing attackers control of their computers. Scammers exploit Power BI's subscription feature so messages come from a trusted Microsoft domain with no malicious links, bypassing filters until Microsoft temporarily disabled the abused feature.

GOOGLE WARNS OF ACTIVE EXPLOITATION OF WINRAR VULNERABILITY CVE-2025-8088

Russian, Chinese, and financially motivated actors are abusing CVE-2025-8088 in outdated WinRAR to gain persistence via Windows Startup, delivering malware.

PARANOID WHATSAPP USERS REJOICE: ENCRYPTED APP GETS ONE-CLICK PRIVACY TOGGLE

WhatsApp is rolling out Strict Account Settings, a one-tap lockdown that hides activity and profile details, blocks high-volume unknown messages, enforces two-step verification, and enables security alerts.

UK PLANS SWEEPING OVERHAUL OF POLICING AMID SURGE IN ONLINE CRIMES

The UK government unveiled plans to create a new National Police Service to centralize the fight against cybercrime and fraud.

productivity by 22%. TRY ASANA FOR FREE →

OPENAI SETS EARLY CHATGPT AD PRICING AT ABOUT $60 CPM

ChatGPT ad pricing is starting almost 3X higher than typical Meta rates and closer to premium TV or live sports inventory. Advertisers will only get basic metrics like impressions and clicks, with no conversion or attribution data. Early campaigns will be more about reach than performance. OpenAI is rolling out ads in the coming weeks on the free and Go tiers, targeting large brands through agencies.

GOOGLE EXPLORING WAYS TO ALLOW SITES TO OPT OUT OF AI OVERVIEWS & AI MODE

Google is exploring new controls that would let websites opt out of having their content used in Search AI features like AI Overviews and AI Mode due to new UK Competition and Markets Authority requirements. It said the controls would give sites more choice while avoiding changes that could break Search or create a confusing experience for users. The CMA proposal would require it to give publishers transparency and opt-out options for AI Overviews and for AI training outside of Search, along with clearer attribution in AI results. The proposal would also require fair and transparent ranking practices, mandatory choice screens on Android and Chrome, and improved data portability for users and businesses.

REPLYING TO YOUR INSTAGRAM COMMENTS CAN BOOST ENGAGEMENT BY 21%

A large-scale analysis across nearly 68,000 accounts found that creator replies correlate with a 21% engagement increase relative to typical performance. The lift appears across different content types and is reinforced by multiple analytical methods, including fixed-effects modeling and Z-score comparisons. Instagram's algorithms reward sustained interaction and repeated account-to-account engagement. Replying early and consistently keeps posts active longer and increases the likelihood of follow-on engagement.

THERE ARE 3 KINDS OF “GOING VIRAL”, BUT ONLY 1 HELPS YOUR BUSINESS

Most viral content falls into empathy or debate, creating visibility without durable value or consistent conversion. The most profitable form is resource virality, where posts deliver tactical utility that audiences actively save and reuse. These posts grow more slowly but establish authority and long-term distribution. Success depends on clarity and designing content explicitly for future reference or shares.

FROM ADS TO ENTERTAINMENT: HOW TO WIN ON SOCIAL IN 2026 (WEBINAR)

The panelists will walk through how to create content that drives both brand love and business results. They'll present their entertainment-first content framework and “brandformance” model. The free event will take place on Saturday, January 31, at 8 AM PST.

INTRODUCING THE KLAVIYO APP IN CHATGPT

The ChatGPT app gives marketers direct access to real-time Klaviyo data, including sends, opens, clicks, conversions, and attributed revenue, all displayed inside a single conversation. Users can tap into deeper analysis for any campaign or flow to review benchmarks, cohort performance, optimization opportunities, and more. The experience works across devices, effectively enabling mobile access to performance reporting for the first time. Future releases will add list analysis and one-click campaign creation from prompts.

HOW AI IS CHANGING MARKETING ATTRIBUTION

AI is changing marketing attribution by reconstructing full deal stories from structured and unstructured data instead of relying on simplified touch models. Traditional attribution fails because data is incomplete and noisy. Adverity found 45% of marketing data is unreliable, while 43% of CMOs trust less than half of it. AI can capture buyer context from calls and emails, analyze sequences at scale, and reveal hidden drivers such as referrals that accounted for a third of revenue in one case or motions that converted at 2x the rate of cold outbound. This approach depends on strong data quality, and it can reduce reporting time to minutes while uncovering gains like a 5% pipeline lift from events that older models missed.

A REFLECTION ON SEO & AI SEARCH IN 2025

Most GEO tactics recycled core SEO, while risky shortcuts threatened long-term visibility. AI search cut clicks but increased upstream influence, pushing marketers to track brand presence, not traffic. Traditional SEO still powers AI answers through indexing and ranking. The real shift is toward brand mentions, multimodal content, and off-site credibility. AEO expands SEO, not replaces it, and Google remains the main source of website traffic.

GOOGLE BEGINS ROLLING OUT CHROME'S “AUTO BROWSE” AI AGENT

Chrome now includes an autonomous browsing agent that can complete multi-step web tasks like research and comparison shopping inside the browser. The agent runs in the background, opens and manages tabs on its own, and checks in only when user input or approval is required. It integrates tightly with Google services such as Gmail, Calendar, Maps, Shopping, and Flights, expanding what AI can execute without manual navigation.

AI IS NOW CITING YOUTUBE MORE OFTEN THAN REDDIT

AI is now more likely to cite YouTube's library of long-form videos.

7 TIPS TO FINDING A HIRING MANAGER ON LINKEDIN

Reverse-engineer hiring managers through LinkedIn posts, referrals, and internal employees.

INSTAGRAM SIZE GUIDE 2026

This guide breaks down the exact IG sizes to use so nothing gets cropped.

YAHOO IS ADDING GENERATIVE AI TO ITS SEARCH ENGINE

Yahoo Scout is a new AI-powered 'answer engine' powered by Anthropic's Claude. It synthesizes information from the web and Yahoo's own data when constructing responses to natural language queries. The interface includes visible source links aimed at making answers easier to verify. The engine behind Scout will become more personalized as time goes on.

AMAZON TO SHUT DOWN ALL AMAZON GO AND AMAZON FRESH STORES

Amazon is closing all Amazon Go and Amazon Fresh physical stores and will shift its focus to online same-day delivery and expand its Whole Foods market business. The Go and Fresh stores failed to deliver a distinctive customer experience and couldn't be scaled up. Some of the shuttered stores will be converted into Whole Foods stores. Amazon plans to open 100 new Whole Foods stores in the coming years.

AUTOMATING BIOLOGY

Biology is wildly complex, and our understanding of biological systems is just scratching the surface. Automating biology will require significant investment to achieve exit velocity. However, once we achieve it, we'll be able to explore the galaxies of genes, proteins, and microbes living all around us. These developments will pave the way for novel therapeutics that will improve health and longevity, boost biomanufacturing, and more.