Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Snyk found four "Leaky Vessels" vulnerabilities in core container components that allow container escape to access host OSes. This could let attackers steal sensitive data and further attacks. Users should urgently check for security updates from container vendors and upgrade engines/tools once fixes are available.
Schneider Electric suffered a data breach after a Cactus ransomware attack hit its Sustainability Business division. The hackers claim to have stolen terabytes of data. The attack impacted the Resource Advisor cloud platform, causing outages.
A new glibc vulnerability that could lead to local privilege escalation in Debian, Ubuntu, and Fedora systems has been discovered. The vulnerability is a heap-based buffer overflow in glibc’s __vsyslog__internal() function, which is used by syslog and vsyslog. Researchers also uncovered three other vulnerabilities in this function and another one in glibc’s qsort() function.
A threat actor known as WS has uploaded 9 malicious Python packages to the PyPI index. The packages contain base64 encoded PE files that drop and execute the WhiteSnake malware onto an infected device. The WhiteSnake malware is an InfoStealer that contains Anti-VM mechanisms. It utilizes Tor to communicate with a C2 server.
This post from Trail of Bits contains 30 new freely available Semgrep rules that it created for Ansible, Java, Kotlin, shell scripts, and Docker Compose. It also contains a detailed discussion of the pros and cons of Generic mode as a means of searching without syntax awareness, as well as an overview of the advantages of using YAML mode for scanning YAML files.
This article is the second part of a series analyzing a C2 agent. In this part, the author focuses on the static analysis of the binary to understand its workings, determine if it corresponds to a C2 agent, and identify indicators of compromise. They use tools like PEStudio and dnSpy to analyze the binary and determine that it is a C2 agent binary.
PeCoReT is a Pentest Collaboration and Reporting Tool designed to be a fully open-source collaboration platform tailored for pentest projects.
Aim Security is a GenAI security platform designed to protect generative AI apps from prompting attacks and prevent malicious/non-compliant outputs with a focus on safeguarding privacy and stopping data leaks.
Mobile Security Framework (MobSF) is an automated mobile application security testing platform for Android, iOS, and Windows Mobile devices. The framework includes static analyzers as well as dynamic analyzers. MobSF also includes REST APIs and CLI tools to integrate into CI/CD pipelines.
Ripple co-founder Chris Larsen disclosed hackers stole around $112M in XRP crypto from his personal wallets on Tuesday. He caught the unauthorized access quickly, freezing affected accounts and notifying exchanges and law enforcement.
A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server.
The U.S. government has disrupted a botnet that was used by state-sponsored hackers from the People's Republic of China (PRC) to conceal hacking activities targeting critical infrastructure organizations in the United States and other countries. The operation removed the malware from the routers and severed their connection to the botnet.
Johnson Controls International (JCI) spent $27 million remediating a September 2023 ransomware attack on its systems.
Europcar has announced that a data breach that alleges to have leaked its customer data is fake. Troy Hunt concurs with this and says that the sample data doesn’t make sense.
A Chicago man and his co-conspirators have been charged with running the nation’s largest SIM swap scheme yet. They stole over $400M in cryptocurrency by targeting over 50 victims in more than a dozen states.
Google Search is adapting to TikTok's influence and vast content library by integrating TikTok videos into Featured Snippets and its AI-powered 'SGE'. The move is most likely targeted at younger demographics, who heavily engage with TikTok.
Engaged-view is Meta’s new attribution setting for advertisers to measure conversions within 1 day of a video ad play. It caters to the trend of viewers delaying actions to avoid disrupting their experience. The feature can be used along with other attribution settings to better analyze and optimize video ad campaigns. Benefits include more results for the same budget, better insights into a customer’s journey, and a deeper understanding of the value of video ads.
Personalized emails leverage data to tailor relevant content to individual subscribers. Countdown timers are a powerful visual tool for encouraging subscribers to take action while building anticipation for what’s to come. Adding products based on weather forecasts is a good way of including relevant product selections for a subscriber. Social signals show how many times subscribers have interacted with something, making it clear to them how popular each product is. This in turn motivates them to click on the products more.
Elverys Sports couldn’t gather useful data about its Facebook ad performance because of Safari ITP and browser blockers, resulting in poor ROAS and minimal insights to improve the ads. The team implemented server-side tagging using Facebook’s Conversion API, which provided more data while staying compliant. This resulted in a ROAS boost of 52% and enabled the brand to optimize its ads based on performance.
Testers for user testing tools are often looking to take as many tests as possible to maximize their earnings. When users guess the answers that get them accepted to take the user test, it means your test pool isn’t really your target audience. To prevent this, avoid using simple 'yes' or 'no' screener questions. Instead, use multiple-choice questions with a few dummy responses to reject guessers. You can also include follow-up screener questions to ensure they haven't just guessed correctly. This post includes an example of a poorly-written screener and a recommended version to use instead.
Benchmarks can provide a useful reference point when evaluating your own product’s performance. This post discusses week-over-week user growth, activation rate, and retention for both B2C and B2B SaaS. It also provides AAR growth, net retention, and churn rates for SaaS overall. Be sure to consider the unique circumstances of your company, product, and market when comparing these metrics to yours.
SmartMarketing.me was created by Dan White, a marketer with 30 years of experience. White uses imaginative visuals to bring marketing concepts to life. The “Illustrations” section of the site contains a library of drawings that cover strategies like brand development, positioning, and pricing. It also includes case examples from brands like Tropicana, Dove, and Nintendo.
Social Media Community Management Guardrails documents are designed to help your team consistently respond to questions, comments, and customer support or care-centric needs. These guides should include elements such as brand persona, sample responses for both positive and negative comments, and what not to respond to. It’s critical to train your social teams on these guardrails and make regular updates as needed. This article describes how to build a guide and example social moderation scenarios to be prepared for.
“Friendly fraud”, also known as first-party fraud, occurs when customers file a fraud claim or charge-back despite being satisfied with a purchase. Any business that accepts digital payments is a target. Research revealed that 42% of Gen Z admit to engaging in first-party fraud. The majority of them don’t realize what they’re doing is fraud and are unaware that it’s the merchant who absorbs the cost of the chargeback. This article highlights tips for brands to protect themselves including prioritizing clear customer communications, offering quick refunds, and collecting detailed records of customer transactions.
There are legal implications and ethical concerns surrounding the use of celebrity likeness in brand social content.
A curated list of marketing courses offered by Google Skillshop, Acadium, and HubSpot Academy that covers personal branding, marketing analytics, and influencer marketing.
Effective communication is crucial for business leaders to persuade stakeholders. To better connect with the audience, it is better to tailor messages, adopt structured improvisation in presentations, balance data with stories, and focus on educating rather than trying to impress.
Sponsored
Devs are there to build software. If they’re getting bogged down with ad-hoc requests for data access, something’s gone wrong — and that’s why you need Basedash [5]. Simply connect your database, [5] and Basedash will use AI to generate an interface. Voila, now anyone can work with data using admin panels, internal CRMs, dashboards, or SQL queries [5] (the AI can write those for you too).
Tembo built its customer data warehouse with only PostgreSQL using foreign data wrappers (FDWs) and other PostgreSQL extensions to simplify the process. It needed to pull data from various sources, including Postgres, Prometheus, and Clerk, into a single location to create dashboards for tracking customer usage and behavior. Instead of introducing new tools and technologies, Tembo utilized FDWs to connect PostgreSQL to these data sources, creating two new FDWs, clerk_fdw, and prometheus_fdw, for Clerk and Prometheus respectively. It also used pg_cron for scheduling updates and pg_partman for partitioning to improve performance and automate data retention.
Web interoperability makes the web accessible and consistent across different browsers. The Interop Project aims to improve interoperability by encouraging browser engine teams to focus on specific areas. The focus areas for Interop 2024 include accessibility, CSS Nesting, custom properties, and Declarative Shadow DOM. Interop is also investigating projects aimed at improving accessibility testing, mobile testing, and WebAssembly testing.
The author’s favorite Git commit is a message from their time at the Government Digital Service while working on GOV.UK. The commit message, titled "Convert template to US-ASCII to fix error," is valued because it provides clear explanations for the change, is searchable, tells a story about the problem and its resolution, and helps spread knowledge and build trust within a team. Good commit messages are helpful in maintaining a codebase's history and improving collaboration among developers.
React has faced criticism lately for becoming overly complicated despite its wide use across the industry. When choosing a web framework or library for a project, it’s important to consider various factors, such as project requirements, performance needs, and team capabilities. Instead of following social media trends, developers should choose the best tool for the job, which is sometimes React or sometimes something else.
Stanchion is an SQLite 3 extension that brings column-oriented storage to SQLite. SQLite exclusively supports row-oriented tables, but Stanchion changes that. Column-oriented storage is generally better for analytics queries over many rows and few columns and metric, log, event, and time-series data.
Jolt is a JSON structural transformation library that is useful for transforming JSON data from databases or extracting data from large JSON documents for your own consumption.
In November 2023, Cloudflare detected a security incident where a threat actor gained access to its self-hosted Atlassian server. Despite this, Cloudflare assured its customers that no customer data or systems were affected. The incident was traced back to stolen credentials from an Okta compromise in October, with the threat actor conducting reconnaissance and accessing internal systems, mainly Atlassian products. Cloudflare responded with a "Code Red" effort to strengthen security, rotating over 5,000 production credentials, segmenting systems, and performing forensic triages. The threat actor was ultimately denied access. Cloudflare notes that it believes the attack was performed by a nation-state.
Apple announced big changes for iOS, Safari, and the App Store users in the EU. For developers, the changes include new options for app distribution and payment processing. For web developers specifically, Apple is introducing a choice screen that will surface when users first open Safari in iOS 17.4 or later. That screen will prompt EU users to choose a default browser from a list of options. Apple has also introduced alternative, opt-in-optional business terms for apps in the EU, which include reduced commission on app transactions, a 3% fee when using the App Store’s payment processing, and a core technology fee of €0.50 for each first annual install per year over a 1 million threshold.
When you convert a file, such as an M4A to MP3, it involves several steps like decoding, re-encoding, and copying metadata. On the other hand, simply renaming a file doesn't change its internal data or format - it remains encoded in the original format. Changing a file's extension by renaming it may result in losing metadata.
SpaceX’s laser system for Starlink is delivering over 42 petabytes of data per day across 9,000 lasers.
Google is reducing the number of free Recaptcha assessments from 1 million to 10,000 a month and introducing new pricing models for paid tiers.
Before deploying, it’s useful to optimize images, have a 404 page and favicon, minify files, certify the SSL certificate for the site, check responsiveness and accessibility, and use fallbacks.
Bard Advanced, which will be powered by the Gemini Ultra architecture, will be available to users as a subscription. Google has yet to reveal how much the subscription will cost or when it will be released. It will likely be available to early testers before being widely rolled out. Alphabet recently revealed that the company earned more than $15 billion in 2023 from subscription revenue.
Files for a quantized version of Mistral were leaked on HuggingFace on around January 28. Quantization is a technique that makes it possible to run certain AI models on less powerful computers and chips. The model surpasses every other LLM in the world except GPT-4 on EQ-Bench. Mistral appears to still be working on the model, so the final version may be even more capable.
An MIT biotechnology PhD student has created a rudimentary screen capable of displaying Doom using a simulation of E. coli bacteria. It takes roughly 70 minutes to display a single frame of Doom on the bioluminescent bacteria. A full reset takes eight hours and 20 minutes. A video about the project is available in the article.
Forsea Foods in Israel is the first company to produce lab-grown freshwater eel meat. It aims to have its product on sale in about two years. The company's goal is to match the price of wild-caught eel. Forsea Foods' strategy is to target species at risk of extinction that also command high prices in restaurants and shops. It has raised $5.2 million in investments, with more expected to be announced soon.
Sponsored
QA Wolf [9] offers a cost-effective approach to getting 80% test
They build and maintain your test suite in Playwright + include unlimited parallel test runs on their infrastructure (24-hour maintenance included).