SEC staff clarified that liquid-staking receipt tokens tied to non-security crypto assets like ETH generally are not securities when they simply represent ownership of the underlying staked asset and do not add separate rights, returns, or managerial promises. The guidance builds on the SEC's earlier position on liquid staking, but remains staff guidance rather than binding law, meaning its treatment could change through future rulemaking, legislation, or a different administration.
Ramp is staging Bill Pay The Musical for one night on Broadway on September 25, starring Billy Porter, Billy Zane, and Jessica Vosk as an elaborate promotion for its accounts payable product.
Product work creates both output and learning, and AI risks accelerating the first without compounding the second.
The old BNPL model made borrowing feel like a payment choice rather than a credit decision.
Sponsored
Your business moves quickly. Your money should, too. Stripe Treasury brings payments and financial tools together, helping you pay vendors, send payouts, issue cards, and manage cash flow with less complexity. Instead of stitching together separate systems, your team can manage more financial workflows on the platform you already use for payments. That means less time navigating disconnected tools and more time focused on your business.
From everyday operations to your next stage of growth, Stripe Treasury gives you flexible infrastructure to move money faster, streamline how work gets done, and build financial operations that can adapt as you scale.
Buy a business that already has customers, the licenses, and the trust, and then change how the work gets done with AI agents. Around $5 trillion worth of businesses in the US will change hands by 2035. Most of these belong to boomers heading into retirement. Many of them have nobody lined up to buy them. This guide walks readers through how to find the right business, buy it, and run it with agents.
Pat Grady frames AI as a technology wave that is bigger, faster, and fundamentally different because progress increasingly comes from computation. His reflection for Boston College's Investment Committee examines how that shift is reshaping technology and investing.
The last generation of enterprise software was built around proprietary data and workflows. The next will be built around the intelligence derived from them. Frontier labs will continue pushing the ceiling of general intelligence, but enterprises will take that intelligence and teach it what only they know. Companies with enough proprietary data, expert judgment, workflow volume, and distribution will have the raw materials to produce proprietary intelligence of their own.
2026.09.28·aspiringforintelligence.substack.com·6 min read·TLDR Founders You will always regret letting one of the truly irreplaceable people on your team leave. This usually happens with scale. As things change, you need larger teams and different processes, and new executives may not think these employees are so irreplaceable. However, they are the ones who truly know how and why everything works and are often the best to help figure out how the next move can work. Top performers are the people you'd rehire into their role - irreplaceables are the ones you would rehire into a role that doesn't exist yet.
An acquirer may love your product and still decide it's faster to build its own. Gusto's cofounder explains that AI has shortened the time the company expects internal development to take, making acquisitions harder to justify. His example is hypothetical. If buying a company saves 18 months' worth of $50 million to Gusto, a business with $5 million in revenue might fit at a 10x multiple. One with $50 million in revenue probably won't. Your revenue can raise your asking price without increasing how much development time the buyer saves.
Sponsored
The hard part of payroll, HR, and benefits integrations was never the code — it's walled gardens, data mapping, and auth. A Finch engineer explains what AI changed, what it didn't, and when building wins.
n8n now has Agents. Developers describe what an agent should do, give it a model, tools, and workflows, and it works out the steps itself. An agent can be reached through Slack, run on a schedule, or called from any workflow. The same agent runs in every one of those places. Videos on how to use the agents in real-world applications are available.
Parallel provides data connectors that connect agents to sources beyond the public web. Categories span company, people, financial, commerce, web, news, and health care & life sciences data. Visitors can request a source or connect their data to the platform. Pricing is pay-as-you-go, and users can run up to 5,000 requests per month for free.
Alexandria is a knowledge library for superintelligence that gives agents tools like the live web, official providers, and specialized indexes. It provides a world of data with just one library. There are over 113 million indexed sources, 93 providers, 640 capabilities, and 20 categories. Data providers can join a waitlist to get paid for sharing their data.
Before Cal AI reached a reported $50 million in annual recurring revenue, one founder's mom had to co-sign the company bank account. Two of the four founders were still in high school. People now ask how they assembled that team, but the answer involves a cousin's YouTube recommendation, a cold DM, and meeting a future cofounder while working at another startup. There was no recruiting process to copy. The advice is more realistic: look for someone who is available and can learn, and expect to offer enough money or equity to make joining worthwhile.
2026.09.28·operatorsnotebook.beehiiv.com·4 min read·TLDR Founders Software accrues value by creating dependencies that compound over time and raise switching costs. These dependencies compound internally as the product embeds deeper into workflows and externally through network effects and ecosystem adoption. Dependencies inside critical systems get a value multiplier because ripping them out threatens the business itself. Resulting revenue from these embedded software systems funds new features that create new dependencies, creating a Value Accrual Flywheel.
Sponsored
After nearly a decade of R&D, Doroni unveiled a showroom model of its H1-X flying car. Morgan Stanley projects a $9T market by 2050. First deliveries are targeted for 2028.
PULL makes startups take off as long as they design everything around it.
2026.09.28·thephysicsofstartups.substack.com·14 min read·TLDR Founders Supervoting shares allow founders to control companies with minimal ownership by granting disproportionate voting rights.
Every AI tool is missing critical features needed to do real work with it.
Qualcomm launched Snapdragon Sound Elite Gen 2, its first audio chip built for AI agents, with low-power Wi-Fi 6E so earbuds can reach cloud services without a phone. It claims up to twice the AI capability of the Snapdragon S7 Gen 1 in a package up to 30% smaller. Cleer showed a camera-equipped earbud concept that could answer questions about what the wearer sees.
Qualcomm and Apple have extended their global patent licensing agreement that was previously set to expire in 2027. The new deal will take effect on April 1. The companies did not disclose how long the renewed agreement will remain in effect. While Apple has not officially commented on its modem plans going forward, it is expected to eventually move away from Qualcomm modems altogether.
Apple has been ordered to pay more than $5.7 billion to Taction Technology, a small haptics company, for infringing on two of its patents. The verdict is the largest patent award in US history. The jury found that Apple's Taptic Engine infringed on patents from Taction, but that Apple did not infringe on purpose. Apple has rejected the verdict and said it would appeal.
Chinese companies have moved first to commercialize glass substrates, building production lines and accelerating product manufacturing and customer qualification. Korea is taking longer to build production lines as companies are trying to validate each process before making investment decisions. China is building the equipment first, making the products, and then having customers evaluate them, so it is faster in terms of commercialization speed. The country has built its own ecosystem spanning display, printed circuit board, and equipment suppliers.
Boston Dynamics has opened a new robotics center at Hyundai Motor Group's Metaplant America. The company began pilot operations at the robotics center in June and recently transitioned to full operations. The center serves as a test bed and training center for integrating Boston Dynamics' Atlas humanoids across Hyundai's automotive factories. The companies hope to have the robots performing component assembly by 2030.
This article looks at the current state of quantum computing, looking at different vendors and their progress.
Satellite navigation systems are surprisingly vulnerable to a variety of attacks, ranging from jamming to more sophisticated spoofing attacks. Europe's Galileo GNSS system aims to fix this. The system produces a cryptographically secured position to prevent spoofing. While it is complicated, it works, and tests show that a stable lock can be achieved on the receiver even during spoofing. The method can, in principle, be extended to other GNSS systems.
A GPU just needs to lose enough of the business its next owner expected to serve for its value assumption to fail. Increasingly capable inference on phones and laptops threatens that business. Edge adoption weakens the case for treating cheap inference as a dependable floor under GPU residual values. Once local execution meets quality, latency, memory, and battery requirements, end users may no longer require data center compute.
Most tend to think of caches strictly in terms of capacity, and that suffices for most purposes. This post looks at chip designers' motivation for a way predictor. It looks at how they work, when the hardware misbehaves, how to detect issues, and workarounds.
2026.09.28·parallelprogrammer.substack.com·15 min read·TLDR Hardware OS kernel compilation times have become a signature benchmark over the past two decades.
At the TSMC OIP Conference, SK hynix focused on showcasing its technological capabilities and product lineup while further defining and expanding its collaborative relationships with TSMC and other key partners.
Qualcomm has introduced an architecture that supports 1-bit AI models in Snapdragon AR1 and AR1+, as well as Snapdragon Sound Elite Gen 2.
Sponsored
Scaling deployments means more east-west traffic between pods and services — harder to inspect, easier to exploit. Static firewall rules and manual certificate management can't keep up.
Palo Alto Networks VM-Series Next Generation Firewall [4] on AWS can help:
* Automate TLS certificate lifecycle: AWS Certificate Manager Private CA handles rotation in Amazon EKS * Adapt policies dynamically: Respond to AWS tags and metadata as your environment changes * Block threats inline: AI/ML-powered inspection in real time without deployment latency
Access technical tutorials [5] and start your free trial [4] in AWS Marketplace.
On September 24, attackers stole $387.5 million from Bitget's hot and warm wallets by feeding false transaction data into a compromised backend system, which then authorized the transfers. Bitget detected unauthorized activity at 18:31 UTC, paused withdrawals hours later, and ruled out private-key theft. Mandiant and SlowMist are investigating. CEO Gracy Chen has flagged possible North Korean involvement.
Zenity identified three Salesforce Agentforce weaknesses. Attackers could inject commands via Web-to-lead forms and bypass URL filters. If connected to Slack, they could post phishing links in internal threads. The lack of confirmation and attribution controls made messages appear to come from employees or IT. Salesforce added confirmation prompts, spec-compliant URL parsing, and centralized URL inspection.
Cloudflare remediated a cross-tenant flaw in Containers and Sandboxes that allowed a Workers Paid customer to read residual disk blocks left by other tenants on the same host. The flaw stemmed from dm-thin storage pools running with skip_block_zeroing, so a 4 KiB write into a reused 64 KiB block left the untouched 60 KiB readable via a raw read of /dev/vdc. Accomplish's Oren Yomtov, who reported it through HackerOne on September 4, recovered directory structures, database pages, and complete SQLite databases on 18 of 24 placements across 20 of 22 nodes, though an attacker could not target a specific victim or read an actively attached disk. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks, and cleared cached image snapshots by September 19. Its disk-I/O telemetry review found no exploitation beyond authorized validation, so no customer action is required.
Zero Salarium details a remote process injection technique that skips the heavily monitored VirtualAllocEx and WriteProcessMemory pair, instead spawning an interactive console child (nslookup.exe or netsh.exe) and writing shellcode into its memory via WriteFile on the child's hStdInput pipe, then using VirtualProtectEx to add execute permissions and a thread hijack to point RIP at the payload. A distinctive marker locates the planted bytes, and the payload must avoid 0x0D, 0x0A, and 0x1A, which the console would treat as command input. Since the classic API pair is absent, defenders should watch for VirtualProtectEx against remote processes, read/write activity on named pipes, and the console's command-storage memory region.
Galileo has demonstrated its first real-world civil position fix using the upcoming Signal Authentication Service, holding a stable lock across five satellites during live spoofing at the Jammertest event in Andøya, Norway on September 16. SAS encrypts the E6-C ranging signal's spreading codes and publishes the decryption key on a delayed, separate channel, letting a receiver correlate the recorded signal only after the fact to confirm each satellite's pseudorange. It pairs with the already-operational OSNMA, which authenticates the navigation message itself. Both services will be free and worldwide, extend to the High Accuracy Service, and let receivers detect and reject a broad range of spoofing attacks. However, EUSPA still must run SAS validation and accreditation before declaring the service operational, and the delayed-key design leaves jamming and meaconing as open concerns.
OAuth token abuse gives attackers application-level access that survives password resets and MFA, since tokens belong to the app rather than the user, and can be obtained through consent phishing, device code phishing, credential additions to existing apps, or preconsented first-party applications. Because malicious apps live in the attacker's tenant, defenders should watch victim-tenant Entra ID events (Add service principal, Consent to application, Add delegated permission grant, and app role assignments) alongside anomalous post-consent activity, with behavioral app-to-purpose checks coming from Defender for Cloud Apps rather than native audit logs. The highest-value controls are preventive: restrict user consent to verified low-impact apps, require admin approval for high-risk scopes like Mail.Read and offline_access, and keep an approved application inventory, since eviction requires removing the grant and service principal rather than resetting credentials.
Sponsored
See how cloud AI and agentic systems introduce new risks across identity, data, and workflows. This on-demand demo explores IAM and access controls, sensitive-data protection, and modern detection strategies to help strengthen governance across the AI lifecycle.
RCEKit is an RCE detection and confirmation toolkit for authorized penetration testing, red teaming, and security research. Point it at a target you are authorized to test — a URL or a captured HTTP request — and every finding returns with the tier it earned.
ADE Skills, from Koifsec and Nikolas Bielski, is a knowledge base for adversarial detection engineering: the study of the gap between what a detection rule is intended to catch and what it literally matches. It organizes detection-logic bugs into a taxonomy of four categories (reformatting in actions, omitted equivalents like pwsh.exe vs powershell.exe, context development, and inverted or missing-field logic) across fifteen subcategories and thirty-seven worked technique files, each pairing a vulnerable rule with a hardened one. It also ships platform bug-pattern catalogs for Elastic, Sentinel, and Sigma, a false-negative checklist, a machine-mined catalog of ~593 candidate bypass findings across public rulesets, and Redamon, a purple-team scoping skill that maps in-scope techniques to a target's actual SIEM/EDR rules.
Mecatl is an open-source, cloud-native agent harness. Mecatl keeps the agent loop independent of the client and execution environment, so the same runtime can start locally, run remotely with durable external state and a recorded event history, and then scale across Kubernetes replicas without replacing the loop.
UpGuard found around 16,000 publicly accessible Supabase-hosted databases leaking names, addresses, phone numbers, and some passwords or tokens. Exposed data included private chats with sex workers on an Indian adult site, thousands of US valet license plates, immigration-service contacts, an African consulate's records in France, and a virtual SIM farm used to intercept OTP texts for scams. Most datasets were in the US, but the issue spans multiple regions. Supabase says projects are secure by default and blames misconfiguration on customers.
Researchers demonstrated a classical-computing attack that forges RSA signatures without factoring the private key. Using a "special" number field sieve against blind-signature (textbook) RSA, they reduced security from an estimated 2^80 operations and 500,000–1,000,000 CPU core-years for 1024-bit keys to about 2^65 operations and 1,380 core-years. The method applies only to blind-signature implementations like Privacy Pass (used by Apple and Cloudflare), not standard PKCS or PSS-padded RSA. Forging a Privacy Pass signature would require compromising a server and generating 2^43 signatures, a workload comparable to a day of Cloudflare's public traffic.
A financially motivated operator ran three open-source AI harnesses (Strix, Cairn, and Hermes) against hundreds of online retailers from July to mid-September, spending roughly $12,000–$18,000 on AI model calls. The campaign exfiltrated over 600,000 unexpired credit card records from two victims, injected skimmers into at least 27 sites, and achieved access to assets of a Fortune 500 hospitality firm, a major US airline, and other large retailers. In several breaches, the agent executed a "database wipe after extraction" routine that deleted payment data and, in one case, dropped 180 tables including backups.