Search the archive

Start for free >

HOW WE BUILT THE V0 IOS APP

Vercel's first native iOS app, v0, was built using React Native with Expo. The focus was on building a smooth, delightful AI chat experience. The team faced challenges in areas like keyboard handling, scrolling, and streaming content. They overcame them through composable code, custom hooks, and even native code patching, using libraries like LegendList and React Native Keyboard Controller.

LOAD TESTING: HOW MANY HTTP REQUESTS/SECOND CAN A SINGLE MACHINE HANDLE?

Load testing was performed on a single machine to determine how many HTTP requests per second it can handle, using a Java-based REST API, PostgreSQL, and DigitalOcean infrastructure. The tests were conducted on machines with varying CPU and memory configurations, showing that even a small machine could handle hundreds of requests per second. A medium machine could handle 500-1,000 RPS, while a large machine sustained 2,000-3,000 RPS.

WE STOPPED ROADMAP WORK FOR A WEEK AND FIXED 189 BUGS

“Fixit” weeks are when the engineering team pauses regular work to address small bugs and improvements. During one fixit week, 40 people fixed 189 bugs, improving both user experience and developer productivity. These focused efforts have a lot of benefits on product quality, individual satisfaction, and team morale, emphasizing the importance of preparation, a strict time limit, and gamification.

THE CLOUDFLARE OUTAGE WAS A GOOD THING

A Cloudflare outage, caused by a bad config file, temporarily disrupted access to many popular online services. This outage may be a good thing, as it showed the dangers of internet centralization and over-reliance on a few key players. It's similar to COVID-19's impact on global supply chains, which led to businesses and governments diversifying supply chains more after 2020.

distributed SQL database architecture_._👉 DOWNLOAD THE EBOOK

INTRODUCING CLAUDE OPUS 4.5

Anthropic's Claude Opus 4.5 is the best model in the world for coding, agents, and computer use. It outperforms human candidates in technical skills assessments and shows creative problem-solving abilities, surpassing previous models in various benchmarks. Opus 4.5 is also the company's most robustly aligned model, with better security against malicious attacks.

INTRODUCING ADVANCED TOOL USE ON THE CLAUDE DEVELOPER PLATFORM

Anthropic has introduced three new beta features on the Claude Developer Platform to improve AI agent tool use: Tool Search Tool, Programmatic Tool Calling, and Tool Use Examples. The Tool Search Tool allows Claude to dynamically discover and load relevant tools, reducing context window consumption and improving accuracy by avoiding upfront loading of extensive tool definitions. Programmatic Tool Calling lets Claude orchestrate multiple tools through code execution. Tool Use Examples provides concrete examples of tool usage, clarifying ambiguous parameters and improving the reliability of tool invocations.

THREE YEARS FROM GPT-3 TO GEMINI 3

Gemini 3 can now code complex tasks, design interfaces, and conduct research, showing a shift from chatbots to agentic models capable of acting as digital coworkers. Gemini 3 is capable of PhD-level research, though it still requires human guidance.

THE BITTER LESSON OF LLM EXTENSIONS

LLM extensions over the past three years have shifted from complex protocols like ChatGPT Plugins and MCP to simpler, more accessible methods. Early attempts at extensive API integrations were hampered by model limitations, leading to the adoption of straightforward solutions like custom instructions and repo-level rules. The current trend, shown by Claude Code's Agent Skills, favors giving agents general-purpose tools with simple natural language instructions.

GOOGLE'S NEW 'ALUMINIUM OS' PROJECT BRINGS ANDROID TO PC: HERE'S WHAT WE KNOW

Google's "Aluminium OS" is a new Android-based operating system designed to replace ChromeOS on PCs.

I BUILT AN ACTUALLY FASTER NOTION IN RUST

Imed Adel left Stripe to build Outcrop, a faster, simpler knowledge base alternative to Confluence built in Rust.

LISAGUI RECREATES APPLE'S LISA INTERFACE IN YOUR BROWSER

LisaGUI is a JavaScript project that recreates the user interface of Apple's Lisa OS, the precursor to the Macintosh.

STAPPLY

Stapply is a visual, interactive map of AI jobs available around the world.

🎁 TLDR readers get $200 with code ZTWTLDR26

SHADOWPAD MALWARE ACTIVELY EXPLOITS WSUS VULNERABILITY FOR FULL SYSTEM ACCESS

Threat actors are actively exploiting CVE-2025-59287, a critical deserialization RCE flaw in Microsoft WSUS (patched last month), to deploy ShadowPad malware with SYSTEM privileges. The attack chain uses PowerCat for initial shell access, then certutil/curl to download ShadowPad, which persists via DLL side-loading through a legitimate ELAN binary (ETDCtrlHelper.exe). Exploitation accelerated after public PoC release. Patch immediately and audit WSUS exposure.

CRITICAL 7 ZIP VULNERABILITY WITH PUBLIC EXPLOIT REQUIRES MANUAL UPDATE

CVE-2025-11001 is a directory traversal RCE flaw (CVSS 7.0) in 7-Zip's symbolic link handling that allows arbitrary code execution when users extract malicious ZIP files. A public PoC exploit is available, and Microsoft is tracking active weaponization. It was fixed in version 25.00, but 7-Zip lacks auto-update capability, leaving widespread unpatched installations. Inventory all Windows systems with 7-Zip versions below 25.01 and immediately push updates via Intune or deployment scripts.

COX ENTERPRISES DISCLOSES ORACLE E-BUSINESS SUITE DATA BREACH

Hackers exploited a previously unknown vulnerability in Oracle E-Business Suite to breach Cox Enterprises' network, exposing personal information of nearly 9,500 people. The attack, linked to the Cl0p ransomware group, went unnoticed for weeks and resulted in data being published on the dark web. Cox is offering free identity monitoring, but did not specify which personal data was exposed. It will continue its investigation.

A REVERSE ENGINEER'S ANATOMY OF THE MACOS BOOT CHAIN & SECURITY ARCHITECTURE

The macOS boot process on Apple Silicon is anchored in hardware-level security. It begins with an immutable Boot ROM that uses cryptographic hardware keys fused into silicon to validate and decrypt critical boot components. A layered chain of trust is established, where each boot stage verifies the next using strict signature checks and hardware root keys, preventing execution of unauthorized code. Apple's custom extensions to the Arm architecture provide pointer authentication, branch target enforcement, and a secure execution environment with isolated privilege levels. The Secure Enclave acts as an independent computer managing cryptographic keys, enforcing anti-replay protections, and mediating sensitive data access via a mailbox interface. These mechanisms robustly defend against rollback, replay, and tampering attacks throughout the boot chain.

ALL PATHS LEAD TO YOUR CLOUD: A MAPPING OF INITIAL ACCESS VECTORS TO YOUR AWS ENVIRONMENT

AWS initial access vectors can be categorized into two classes: service exposure (Lambda, EC2, ECR, and DataSync misconfigurations that enable public access) and access by design (Cognito, IAM, and IoT misconfigurations in services intended for access control). 97% of organizations still use IAM users despite best practices recommending roles. 84% use Cognito with potential self-registration risks. ECR repositories are enumerable by any AWS account holder. Security teams should audit resource-based policies for wildcard principals, enforce ExternalId for cross-account role assumptions, disable Cognito self-registration where unnecessary, and validate OIDC trust policy conditions include proper sub/aud claims.

PRACTICAL RESOURCES FOR DETECTION ENGINEERS

Detection engineering is a proactive threat-hunting specialization that applies software engineering processes to detect attackers. Prospective detection engineers should choose a domain to focus on, such as cloud workload security, cloud application security, cloud misconfigurations, endpoint security, network security, IAM, or insider threat. This blog post includes a list of blog posts, videos, and books that both starters and pros could benefit from.

RUNLAYER (PRODUCT LAUNCH)

Runlayer provides a secure control layer for enterprise AI, monitoring access and usage, and blocking threats in real time. It supports the Model Context Protocol for safe, compliant AI transformation across environments.

PROWLER

Prowler is an open-source security tool for AWS, Azure, GCP, and Kubernetes for performing security assessments, audits, incident response, compliance, continuous monitoring, hardening, and forensics readiness. It includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS, and more.

MAGNET

Magnet is a purple-team telemetry and simulation toolkit.

SHAI-HULUD RETURNS: OVER 300 NPM PACKAGES INFECTED VIA FAKE BUN RUNTIME WITHIN HOURS

Over 300 NPM packages were poisoned via compromised maintainer accounts that injected a fake Bun runtime preinstall script that deploys a 10MB obfuscated JavaScript payload to steal credentials. The malware uses TruffleHog for local secret scanning. It exfiltrates NPM tokens and cloud credentials (AWS/GCP/Azure) via rogue GitHub Action runners named SHA1HULUD, and achieves worm-like propagation by republishing infected packages using stolen tokens. High-impact packages affected include @zapier/zapier-sdk (2.6M weekly downloads), posthog-node, and @asyncapi/specs. Teams should audit dependencies for setup_bun.js/bun_environment.js files, rotate any potentially exposed credentials, and pin package versions to known-good releases.

GOOGLE ENABLES PIXEL-TO-IPHONE FILE SHARING VIA QUICK SHARE, AIRDROP

Google has enabled Quick Share interoperability with Apple AirDrop on Pixel 10 devices. The feature was implemented in Rust to eliminate memory-safety vulnerabilities. NetSPI penetration testing confirmed no data leakages. The system uses direct device-to-device connections via AirDrop's “Everyone for 10 minutes” mode without server intermediaries. However, users must manually verify recipient devices to avoid accidental sharing with nearby strangers. Security teams should note that this expands the cross-platform attack surface for social-engineering file transfers.

NEW RADZARAT SPYWARE POSES AS FILE MANAGER TO HIJACK ANDROID DEVICES

RadzaRat is an Android RAT masquerading as a file manager with complete AV evasion (0/66 on VirusTotal) and keylogging capabilities. The malware uses free infrastructure (Render.com and a Telegram bot) and persistence mechanisms that prevent termination and survive reboots. The APK has been openly distributed and actively sold on underground forums by developer 'Heron44' since November 8. Security teams should implement behavioral detection and app vetting policies, as signature-based defenses are currently ineffective against this threat targeting credentials and financial data.

AI TEDDY BEAR FOR KIDS RESPONDS WITH SEXUAL CONTENT AND ADVICE ABOUT WEAPONS

FoloToy's GPT-4o-powered “Kumma” teddy bear spontaneously introduced sexual content, BDSM topics, and dangerous household advice during testing, prompting OpenAI to revoke the developer's API access.

146,000 IMPACTED BY DELTA DENTAL OF VIRGINIA DATA BREACH

Delta Dental of Virginia notified approximately 146,000 individuals after a security breach of an email account exposed personal information.

IBERIA DISCLOSES SECURITY INCIDENT TIED TO SUPPLIER BREACH

Iberia experienced a data breach due to a supplier hack.

AMERICANS' SOCIAL MEDIA USE 2025

Instagram now reaches 50% of adults in the US. It has joined YouTube and Facebook as the only social media platforms to achieve majority adoption among Americans. Its growth from 40% in 2021 signals a shift from a younger audience to the mainstream. Other platforms continue to rise, including TikTok at 37% and WhatsApp at 32%.

THE B2C AI MARKETING IMPACT REPORT

Marketers feel a powerful mix of optimism and urgency around AI. 92% view its impact positively. At the same time, many teams still lack the budgets, data activation, and workflows needed to use it effectively. Most organizations need 2-7 days to act on new insights, which slows progress and weakens AI's value. This gap between ambition and execution fuels overconfidence and widens the disconnect between how marketers believe AI performs and how customers actually experience it.

4 EMAIL PRE-HEADER TESTS TO TRY

Pre-header tests worth trying include removing the pre-header entirely for a clean inbox preview, using continuation words like “and”, “but”, or “plus”, adding emojis only in the pre-header, and starting with short parenthetical cues such as “(quick)” or “(don't skip)”. Each tactic can lift open rates, but performance varies. Run structured A/B tests in your ESP to see what resonates with your audience.

GROW REACH WITH THOUGHT-LEADER ADS

When a LinkedIn post gains traction, build momentum instead of stopping at organic reach. Boost the strongest posts as thought-leader ads, then use the new engagement to retarget and run follow-up campaigns that fit your GTM approach. This turns individual posts into a steady growth engine.

Try Asana for free →

IG'S NEW FEATURES FOR REELS CAMERA

Instagram updated its Reels camera to make capturing and editing videos easier in the app. The most significant change is the ability to record up to 20 minutes. Instagram only recommends Reels under 3 minutes and limits distribution for longer clips. It also improved editing by adding a simple Undo option and a slider to control Touch Up intensity. The update includes enhancements to green screen tools, timers, and countdowns so users can produce smoother clips in-stream.

GEMINI 3 SUPERCHARGED MARKETING: 9 TOOLS & WORKFLOWS

Gemini and Notebook LM turn research and performance data into strategy reports and presentations in hours. Google AI Studio builds live dashboards that guide decisions. Mixbot, Vix, Pomy, and Flow generate visuals and video assets at scale, while Gemini supports fast on-brand copy. Workflow tools like Opal automate briefs and schedules. The post contains a video that shows how Gemini 3 improves output across teams.

STUDY FINDS SIZE REALLY DOES MATTER WHEN IT COMES TO HOME SCREEN ADS

Connected TV home screen ads deliver the strongest attention. Audiences view 76% of these ads, and 59% of that viewing counts as active attention, which means eyes on both the screen and the ad. They also generate 2.5x more active attention than linear TV and avoid the steep drop seen on social platforms, where 80% of attention disappears. The viewing device drives attention more than the platform or creative. As measurement improves, CTV home screens will become even more valuable for high engagement.

HOW VINE'S SIX-SECOND VIDEOS BUILT THE BLUEPRINT FOR TIKTOK

Vine created the core format that powers TikTok, Instagram Reels, and YouTube Shorts. Its 6-second-long looping videos became the foundation of the modern short-form ecosystem. Vine's technical innovations shaped today's platforms, and its role in launching major creators showed the potential of the format. Its failure came from weak creator monetization, a problem that still affects platforms. The platform's cultural and design impact remains central to how billions consume content, even as new startups try to revive its original appeal.

CRO > ADS FOR ECOMMERCE GROWTH

Optimize the clicks you already have before you buy more.

US SENATORS CALL FOR INVESTIGATION OF SCAM ADS ON FACEBOOK AND INSTAGRAM

Meta estimated its platforms were involved in a third of all scams in the US.

5 BEST CAMPAIGNS OF THE PAST 7 DAYS

Campaigns include flying billboards on a drone, typos on a billboard, and leaked content.

tomorrow. Start building

PRODUCER THEORY

Startups keep adding data sources to give their agents better context. This has created a loop where tools are learning from each other's information. The products that stand out will be the ones that produce fresh intelligence rather than those that only combine and redistribute data.

GAS-FIRED INTELLIGENCE, PART 2

AI is creating rapid growth in US baseload power demand. Only natural gas can reliably meet that need today. Renewables will play a bigger role in the future. For now, the grid must expand with gas-fired generation to keep power stable and affordable.