Search the archive

Watch now

OVER 67,000 FAKE NPM PACKAGES FLOOD REGISTRY IN WORM-LIKE SPAM ATTACK

Cybersecurity researchers uncovered a massive spam campaign flooding npm with over 67,000 fake packages dubbed "IndonesianFoods." The worm-like attack, active since early 2024, exploits dormant JavaScript files requiring manual execution to bypass security scanners. Attackers likely monetize the campaign through the Tea protocol by artificially inflating impact scores to earn cryptocurrency tokens, while creating a self-replicating network that strains registry infrastructure and pollutes search results.

CL0P RANSOMWARE LISTS NHS UK AS VICTIM, DAYS AFTER WASHINGTON POST BREACH

The Cl0p ransomware group claimed the NHS UK as a victim on November 11, days after breaching The Washington Post by exploiting CVE-2025-61882, a critical remote code execution vulnerability (CVSS 9.8) in Oracle E-Business Suite versions 12.2.3-12.2.14. The vulnerability was exploited beginning August 2025 before Oracle's October 4 emergency patch, with attacks accelerating after Scattered Lapsus$ Hunters leaked proof-of-concept code on October 3, enabling Cl0p and FIN11 to conduct synchronized data-exfiltration campaigns against hundreds of organizations. Organizations running Oracle EBS must immediately apply the October 2025 patch, conduct forensic reviews dating back to August, and monitor for connections to suspicious IP addresses 200.107.207.26 and 185.181.60.11.

SUSPECTED FORTINET ZERO DAY EXPLOITED IN THE WILD

CREATING A “TWO-FACE” RUST BINARY ON LINUX

A “two-face” binary is a binary that contains a malicious program designed to run on a target host and a benign binary that executes on any other host. To ensure that the malicious program runs only on the target host, it is encrypted with a key derived from the target's disk partition UUIDs. The author of this article developed a twoface Rust binary to implement this process, which also includes defenses to prevent detection of the decrypted binary.

CONFIGURING THE AWS WAF ANTI-DDOS MANAGED RULE GROUP FOR YOUR RESOURCES AND CLIENTS

AWS WAF provides an Anti-DDOS managed rule group to detect and mitigate HTTP DDOS events. By default, the rule group uses a JavaScript challenge for all GET requests with low or medium suspicion and blocks all GET requests with high suspicion of contributing to DDoS attacks. This post provides ways to customize the rule group for scenarios where clients don't support the JavaScript challenge, clients can't use the WAF client integration, non-challengeable requests overwhelm resources, and when challengeable requests overwhelm resources before they're blocked.

PRACTICAL LLM SECURITY ADVICE FROM THE NVIDIA AI RED TEAM

The NVIDIA AI Red Team has observed three common vulnerabilities in the implementation of AI systems. The first vulnerability involves directly executing LLM-generated code, which could lead to remote code execution in the case of direct or indirect prompt injection. The second vulnerability is related to insufficient access controls in RAG data sources, which could allow a user to read data they are not privileged to read or write data to the data store. The third vulnerability is related to active content rendering of LLM outputs, which could lead to information leakage via images or other network requests.

door to secure, responsible AI adoption. Watch the webinar

WIN11DEBLOAT

Win11Debloat is a PowerShell script that removes preinstalled apps, disables telemetry, and performs various other changes to customize, declutter, and improve the Windows 11 user experience.

SWEET SECURITY (PRODUCT LAUNCH)

Sweet Security offers AI-powered security solutions for real-time threat detection and response across cloud and AI environments. The platform uncovers shadow AI, misconfigurations, risky access, and prevents prompt injection and abnormal model behavior.

SHANNON

Shannon is an AI pentester whose goal is to break your web app before someone else does. It autonomously hunts for attack vectors in your code, then uses its built-in browser to execute real exploits, such as injection attacks and auth bypass, to prove the vulnerability is actually exploitable.

MOZILLA FIREFOX GETS NEW ANTI-FINGERPRINTING DEFENSES

Mozilla has announced that, beginning in the recently released Firefox 145, further fingerprinting blocking will be implemented, dropping the percentage of user trackability to 20%. The specific enhancements block requests to discover installed fonts, hardware details, number of processor cores, multi-touch support, and dock/taskbar dimensions. The enhancements will initially be rolled out for users in Private Browsing who set their Enhanced Tracking Protection to Strict.

NHS SUPPLIER ENDS PROBE INTO RANSOMWARE ATTACK THAT CONTRIBUTED TO PATIENT DEATH

Synnovis has completed an exhaustive 18-month investigation into a crippling ransomware attack in June 2024 that affected nearly a million NHS patients, severely disrupted London pathology services and leading to a patient's death. The probe struggled with fragmented data. While no ransom was paid and systems were replaced, many patients must still wait for official notification if their data was compromised.

GOOGLE SUES TO DISRUPT CHINESE SMS PHISHING TRIAD

Google filed a lawsuit in the Southern District of New York against 25 individuals connected to Lighthouse, a Chinese phishing-as-a-service toolkit that has compromised over 1 million victims across 120 countries by spoofing USPS, toll road operators, e-commerce sites, and financial institutions via SMS. The operation captures payment card data through fake mobile sites and then exploits the legitimate Apple Pay and Google Pay enrollment processes by tricking victims into providing one-time authentication codes, enabling attackers to load stolen cards onto mobile wallets they control. Security teams should monitor SMS gateways for brand impersonation, educate users to verify unexpected payment requests through official channels, and watch for unusual mobile wallet enrollment patterns that could indicate credential theft.

ELON MUSK'S X BOTCHED ITS SECURITY KEY SWITCHOVER, LOCKING USERS OUT

Elon Musk's X platform disrupted user access by mishandling a switch from twitter.com to x.com for two-factor authentication using security or passkeys, with many users becoming locked out, caught in error loops, and unable to re-enroll.

GOOGLE PAID OUT $458,000 AT LIVE HACKING EVENT

Google awarded $458,000 in bounty rewards at the ESCAL8 bugSWAT event after 38 top security researchers reported 107 vulnerabilities across AI, Android, and Google Cloud.

Read the case study >

Looking to unlock the full potential of your organic social? Gain exclusive insights and see industry-specific benchmarks in a 1:1 call with an Oktopost expert [5].

MARK ZUCKERBERG WANTS ALL OF ADVERTISING. ANDY JASSY MAY HAVE A STRONGER CLAIM

Amazon appears to be in a stronger position than Meta to control more of the advertising ecosystem due to its growing AI tools, unmatched commerce signals, and major expansion into streaming TV. It claims it can help brands reach 90% of the streaming market through its data partnerships, and it has 80 million authenticated US households feeding its targeting systems. Its new AI tools for creative, planning, and campaign management suggest it could replace many functions handled by agencies, even as some marketers question how fast these tools will be adopted. Meta continues to push its own AI vision, but Amazon's deeper footprint in TV, ad tech, and first-party data gives it an advantage in this emerging battle.

WOMEN ARE DISCUSSING THEIR NEXT CAR PURCHASE ON REDDIT, IS YOUR BRAND ON THE SHORTLIST?

Half of Reddit's 185M weekly US users are now women, many planning car purchases. Three in five expect to buy within two years, and one in four within 6 to 12 months. Reddit is the top platform female car buyers trust, with 68% preferring real people's insights over comparison sites. Two-thirds want brands to share product details, and many engage in auto and life-planning communities where intent is high. Providing useful content and joining discussions through AMAs and Conversation Ads helps brands connect with buyers as they decide.

ANALYZE WHAT CHATGPT USERS ARE ASKING USING YOUR WEBSITE'S BOT TRAFFIC

Analyzing server logs for ChatGPT-User bot visits can reveal what topics real ChatGPT users are prompting about. This provides a data-driven alternative to unreliable third-party prompt volume estimates. Websites can identify which subjects attract the most AI-driven attention by filtering logs for ChatGPT-User activity and clustering pages by topic using LLMs or vector embeddings. Comparing bot visits with human referral traffic highlights whether content is informative but unengaging or blocked from bot access.

HOW THOUGHT LEADERSHIP ADS DRIVE PLG GROWTH ON LINKEDIN

About 80% of the LinkedIn budget goes to Thought Leadership ads that drive strong PLG signups with minimal CTAs. Edited posts with clear next steps and tested objectives perform best, with Engagement outperforming Reach. Diverse voices, a creator engine, and persona targeting keep content relevant, while frequent rotation prevents fatigue. Next steps include adding visuals for brand recall and featuring more employees, customers, and micro-influencers.

WINNING WITH PINTEREST ADS: HOW TO INCREASE YOUR B2C SALES

Pinterest advertising presents a cost-effective alternative to Meta and TikTok, especially for businesses targeting planners and DIY consumers. Its visual search structure supports long-lived campaign assets, enabling ongoing reach well beyond the paid window. Brands should lead with high-performing offers, repurpose content with Pinterest-specific formatting, and structure campaigns to guide users from discovery to purchase. Strategic use of the Pinterest tag, interest targeting, and act-alike audiences increases effectiveness and creates retargeting opportunities.

SOCIABLE.AI

Sociable is a social media automation tool that helps brands identify trending content, place timely top comments, and automate replies across platforms. It filters content relevant to a brand, predicts viral potential, and tracks impressions and interactions. The platform supports outbound community engagement, allows for on-brand AI-generated responses, manages DMs, and provides analytics.

LET AI DO THE HARD PARTS OF YOUR HOLIDAY SHOPPING

Google is expanding its AI-driven shopping capabilities to simplify purchase journeys and reduce friction during the holiday season. Key upgrades include conversational search in AI Mode with dynamic product comparisons, integration of shoppable insights in the Gemini app, and agentic tools that automate local inventory checks and price-based checkouts. These features leverage the Shopping Graph and Duplex technology to increase conversion, enhance user efficiency, and support both online and offline commerce.

I JUST SPENT $20K ON BRANDING BECAUSE OF AI

The rapid rise of AI has made it easier than ever to launch startups, creating a “sea of sameness” that makes strong branding essential for standing out. As automation takes over campaign optimization, ad creative and brand identity have become the final competitive edge. Founder-led content and authentic storytelling are now key to making brands feel alive and credible in an AI-driven market.

ANTHROPOMEME

@superficialsharon, a commentator on absurdist humour on TikTok, explores internet culture through deadpan observations on romance, creativity, and social media anxiety. Her work traces a path from early Instagram meme consumption to meta-ironic communities like @bileboye and @still_on_a_downward_spiral, where hyper-specific humour fosters belonging while reflecting online isolation. She shows how irony and absurdity shape digital communities and create fleeting yet meaningful connections. Her TikTok content channels this sensibility, using humour to highlight human behaviour and the logic of online spaces.

TIP: LINKEDIN JOB SEARCH

Changing LinkedIn search locations can reveal hidden remote opportunities.

YOU CAN JUST READ 25 BOOKS

A list of books curated by a16z on innovation, culture, and marketing.

THE HIDDEN ARBITRAGE IN TIMES SQUARE BILLBOARDS

Featuring others instead of promoting your own brand on a Times Square billboard can unlock high social reach at a fraction of typical ad costs.

Read more on the Metronome blog >

WHAT'S REALLY GOING ON IN SOFTWARE

SaaS metrics have stabilized while AI-native companies grow far faster and reshape productivity across the industry. The strongest growth appears in companies with AI at the core.

IN SEARCH OF THE AI BUBBLE'S ECONOMIC FUNDAMENTALS

AI investment is racing ahead of real returns, creating classic bubble conditions. Most enterprise pilots aren't working yet. True productivity gains may only arrive after today's hype inevitably deflates.

WHY BEING CAPABLE DOESN'T GET YOU PROMOTED

Promotions in leadership depend on business need, not performance alone. The fastest path upward is finding teams with real openings and growth.

THE LENSES

A systems map contains many lenses, but someone must choose which ones matter. Ops succeeds when it brings clarity, not complexity.

HOW TO SHIP A MOBILE APP (AKA THE SUBMISSION GAUNTLET)

Launching mobile apps is harder because Google and Apple require real testing, real feedback, and real judgment. The challenge is not building the app but navigating people, process, and product choices.

AI MARKETPLACES (74 MINUTE PODCAST)

AI makes marketplaces faster, but trust and local expertise still win. ACV Auctions proves that buyer-first trust, clean data, guarantees, and regional depth are what truly scale vertical platforms.

TINDER TO USE AI TO GET TO KNOW USERS, TAP INTO THEIR CAMERA ROLL PHOTOS

Tinder's new AI matching feature relies on scanning users' photos, but the privacy cost seems higher than the benefit. Despite rolling out fresh AI tools and redesigns, the app continues to lose subscribers in a tougher dating market.

THE BIGGEST MODEL UPDATE THIS WEEK

Kimi K2 brings open-source to frontier quality through self-correcting reasoning, beating GPT-5.1 on real-world product decisions. GPT-5.1 now focuses on warmth and tighter instruction-following, making interactions feel friendlier and more reliable.

months free trial when you book a demo

6 MONTHS AT LOVABLE AND WHY I HAD TO THROW OUT MOST OF MY PLAYBOOK

Growth depends on rapid invention, cross-functional work, and letting go of old patterns.

RE-ESTABLISHING FOCUS AND EXECUTION ACROSS THE ORG

DRIs, fast decisions, and a customer-obsessed edge keep the team hungry and focused.

Gram is the MCP cloud. Create, host, and scale MCP servers

without the hassle.

Start building for free