Search the archive

SPARKLE

Sparkle is a cold email outreach tool that handles deliverability, sending infrastructure, and verified leads without requiring manual domain or account setup.

LOKI.BUILD

Loki.Build is an AI-powered landing page builder that generates customizable pages with a live editor, built-in SEO, and hosting.

SHADOW

Shadow is a meeting AI that captures both on-screen activity and conversation to generate context-aware summaries and automated follow-up tasks.

THE PROOF NARRATIVE - HOW INVESTORS EVALUATE CALLS

This article breaks down what investors actually look for on discovery calls. The heart of any investor call is proof - not slides, but evidence. Real customer behavior. Real traction. Scientific markers. Clinical signals. Retention patterns. Proof is anything that shows your company is not a theory. It should be delivered calmly, not urgently. Investors respond to clarity, not hype. When investors say "too early," they almost never mean time. They mean your traction is too thin, or your narrative is ahead of your evidence. The mismatch between ambition and proof creates internal tension that kills deals.

CREATIVE IS THE BOTTLENECK OF MODERN USER ACQUISITION

User acquisition is no longer constrained by bids, targeting, or channels. It's constrained by creatives. High-spend advertisers don't win because they're more creative - they win because they produce, test, kill, and refresh at a speed most teams can't match. Creative fatigue isn't a vague feeling either. CTR goes down, CPI goes up, and by the time teams align internally, the winner is already dead. Once you scale beyond a few hundred thousand in monthly spend, creative management stops being a creative problem and becomes an infrastructure problem.

UNDERSTANDING MARKETERS' NEEDS: A HIERARCHY FOR SUCCESS

The article outlines a hierarchy of marketers' data needs, focusing on self-awareness, competitive awareness, industry trends, sentiment, and strategic projection. Podscan's AI onboarding uses this framework to streamline user alert setups by identifying what data matters most at each level. This approach aids customer understanding, improves engagement, and enhances product relevance, especially for varied customer segments like enterprises and solopreneurs.

WHAT VOLUNTEER OPEN SOURCE TAUGHT ME ABOUT REMOTE TEAMS

Some tips on how to make distributed volunteer teams productive.

TIMING YOUR OVERNIGHT SUCCESS

If it takes three to five years for a project to gain traction, it probably doesn't pay to start something the world knows it needs right now.

IN AN AGENTIC ERA, VC IS BUYING A-PLAYER C-SUITE EXECS AT ANY COST

Venture capital now prioritizes acquiring AI-savvy executives from top tech firms, reshaping the investment landscape.

HOW TO AVOID BECOMING AN “AI-FIRST” COMPANY WITH NO REAL AI USAGE

Many companies adopt AI in name only, creating pressure to “look innovative” rather than driving real transformation.

CRACKED SOFTWARE AND YOUTUBE VIDEOS SPREAD COUNTLOADER AND GACHILOADER MALWARE

CountLoader 3.2 and GachiLoader malware are spreading via cracked software sites and 100+ compromised YouTube videos (220K views from 39 accounts), deploying ACR Stealer and Rhadamanthys through multi-stage attacks. CountLoader uses trojanized Python interpreters that execute via mshta.exe, create persistence with fake Google scheduled tasks that run every 30 minutes, detect CrowdStrike Falcon to adapt its execution, and spread via USB drives. GachiLoader employs Node.js with novel Vectored Exception Handling PE injection techniques and kills SecHealthUI.exe to disable Windows Defender. Security teams should monitor for mshta.exe abuse, suspicious scheduled tasks that mimic legitimate software, WMI queries for AV detection, and modifications to system folders that exclude Defender, and implement application whitelisting to block execution of unauthorized Python interpreters and Node.js scripts.

NEW UEFI FLAW ENABLES PRE-BOOT ATTACKS FROM GIGABYTE, MSI, ASUS, ASROCK

Researchers from Riot Games discovered a UEFI flaw that could allow for Direct Memory Access (DMA) capable devices to load before the operating system. DMA allows for PCIe devices to read and write RAM without going through the CPU and relies upon IOMMU for protection. A physically present attacker would need to attach a rogue PCIe device before boot to exploit this vulnerability.

NEW CRITICAL WATCHGUARD FIREBOX FIREWALL FLAW EXPLOITED IN ATTACKS

WatchGuard is warning users to patch a critical, actively exploited remote code execution vulnerability in its Firebox firewalls. The vulnerability is caused by an out-of-bounds write that allows unauthenticated attackers to execute remote code. Firebox firewalls are only vulnerable if they are configured to use IKEv2, or in some circumstances, even if the configuration was deleted.

TP-LINK TAPO C200: HARDCODED KEYS, BUFFER OVERFLOWS AND PRIVACY IN THE ERA OF AI ASSISTED REVERSE ENGINEERING

A security researcher documented AI-assisted firmware analysis of TP-Link Tapo C200 cameras using tools including Grok, GhidraMCP, and Claude Sonnet 4. They discovered hardcoded SSL private keys that enabled HTTPS traffic decryption, pre-authentication memory overflows, integer overflow crashes, and unauthenticated WiFi hijacking, affecting approximately 25,000 internet-exposed devices. The vulnerabilities enabled remote attackers to decrypt camera traffic, crash devices, force connections to malicious networks, and enumerate nearby WiFi BSSIDs for precise geolocation via Apple's location services API. TP-Link delayed patching beyond its 90-day commitment despite being a CVE Numbering Authority, raising concerns about vendor conflicts of interest when controlling their own vulnerability disclosure pipeline while marketing low CVE counts as a competitive advantage.

MISTRUSTED ADVISOR: EVADING DETECTION WITH PUBLIC S3 BUCKETS AND POTENTIAL DATA EXFILTRATION IN AWS

Researchers from Fog Security discovered three methods to bypass AWS Trusted Advisor and expose S3 buckets without triggering alerts. The three methods are to create a bucket policy that denies s3:GetBucketPolicyStatus, s3:GetBucketPublicAccessBlock, and s3:GetBucketAcl. Fog Security coordinated disclosure with AWS, but noted that it took AWS two attempts to fix the vulnerability and felt that AWS's communication downplayed the severity.

HOW GOOGLE DOES IT: BUILDING AGENTS FOR CYBERSECURITY AND DEFENSE

When introducing agentic AI to its cybersecurity teams, Google began by building trust in generative AI by adding chat interfaces to existing tools. Google security then identified initial use cases for distillation and translation, focusing on bottlenecks that AI could alleviate. The team then established and monitored KPIs as they scaled their program.

can move with agility

ANNOUNCING GOTATUN, THE FUTURE OF WIREGUARD AT MULLVAD VPN

Mullvad's GotaTun is a Rust-based WireGuard implementation forked from Cloudflare's BoringTun that replaces wireguard-go, eliminating 85% of Android app crashes attributed to the Go implementation's FFI complexity and opaque runtime debugging challenges. The Android rollout in November reduced the user-perceived crash rate from 0.40% to 0.01%, with zero GotaTun-originated crashes, while improving connection speeds and battery efficiency through safe multithreading and zero-copy memory strategies. Mullvad plans a third-party security audit in early 2026 before expanding the GotaTun deployment to desktop and iOS platforms, maintaining full WireGuard protocol compatibility while supporting privacy features, including DAITA and Multihop.

KANIDM

Kanidm is a simple and secure identity management platform that provides a full identity provider, covering the broadest possible set of requirements and integrations.

DEDSEC

The DedSec Project is a comprehensive cybersecurity toolkit designed for educational purposes. It provides 50+ powerful tools that cover everything from network security analysis to ethical hacking education. Everything is completely free and designed to help you shift from being a target to being a defender.

DISMANTLING DEFENSES: TRUMP 2.0 CYBER YEAR IN REVIEW

The Trump administration systematically dismantled federal cybersecurity infrastructure: CISA lost 1/3 of its workforce and faces $491M budget cuts, the Cyber Safety Review Board was dissolved mid-investigation of Chinese telecom intrusions, and both NSA and Cyber Command have operated without leadership since April. DOGE accessed sensitive federal databases from SSA, DHS, OPM, and Treasury by circumventing security controls and audit mechanisms, with data exfiltration coinciding with Russian login attempts using valid DOGE credentials. Security professionals should prepare for degraded federal threat intelligence sharing after the elimination of CIPAC and MS-ISAC funding, reduced public-private coordination as agencies canceled meetings with infrastructure operators, and increased foreign intelligence recruitment of laid-off federal employees with security clearances.

DEFENSE BILL ADDRESSES SECURE PHONES, AI TRAINING, CYBER TROOPS' MENTAL HEALTH

In addition to $901B in funding, the 2026 National Defense Authorization Act (NDAA) also includes a series of new cybersecurity policies. The NDAA includes a provision that secure phones provided to senior leaders meet a set of security requirements, such as data encryption. The act also includes increased mental health provisions and training initiatives around AI security.

MINISTERS CONFIRM BREACH AT UK FOREIGN OFFICE BUT DETAILS REMAIN MURKY

UK ministers acknowledge a confirmed cyberattack on the Foreign Office, first reported by The Sun and widely linked in the media to Chinese state-backed hackers, though officials stress those claims are speculative. They say a technical flaw at one site was quickly closed and insist there is currently low risk to individuals, despite concerns about possible exposure of visa application data and growing warnings over China's broader cyber-espionage activity in Europe.

2025 LLM YEAR IN REVIEW

Six paradigm shifts occurred with LLMs during 2025.

UKRAINIAN NATIONAL PLEADS GUILTY TO CONSPIRACY TO USE NEFILIM RANSOMWARE TO ATTACK COMPANIES IN THE UNITED STATES AND OTHER COUNTRIES

Ukrainian national Artem Stryzhak pleaded guilty to conspiracy charges for deploying Nefilim ransomware against US companies.

UNIVERSITY OF SYDNEY DATA BREACH AFFECTS 27,000 INDIVIDUALS

Hackers accessed an online code library at the University of Sydney that contained historical test data files.

SPECIAL OFFER FOR TLDR >> 30% off through Dec 31

(Discount is for all Semrush One plans. Must be a new customer)

AGE GATING THE FUTURE

Age verification is becoming a strict requirement that changes how people experience the internet and what they can access. Australia now bans users under 16 from social media, and noncompliant platforms face fines up to $49.5M. Users will encounter harder identity checks and more friction, resulting in an internet where two people can have very different experiences of the same product depending on where they live, how old they are, and what their parents allow. The shift also drives verifiable anonymity, so people can prove age through encrypted systems while keeping personal identity private.

X SHARES MOST DISCUSSED TOPICS OF 2025

This year's X conversations centered on entertainment and sports, not politics. TV discussion was driven by Netflix hits Stranger Things and Squid Game. Sports remained the largest category overall, led by the Premier League. Cultural moments like the Met Gala also sparked attention, showing X users engaging most around pop culture and sports at scale.

73% OF YOUR ECOMMERCE EMAILS ARE BROKEN (AND YOUR CUSTOMERS CAN'T TELL YOU)

Most ecommerce emails are inaccessible to many shoppers. About 74% of marketing emails have no discernible link text, which forces screenreader users to guess and then leave. Accessibility also matters to a wide audience because 46% of people have at least one disability by age 60. Clear link text, short sentences, descriptive buttons, structured headings, effective ALT text, and careful emoji use reduce friction and can improve conversions.

HOW TO FIND THE PERFECT JOURNALIST FOR YOUR STORY

Hyper-targeted outreach matters because most journalists do not receive relevant pitches. Over 50% rarely get useful outreach, so precise Google searches are needed to find the right authors. Strong results depend on confirming topic fit, recent activity, content format, and whether a journalist links to brands. Tools like ListIQ can cut evaluation time from about 10 minutes per journalist to under a minute.

tech decision makers actually see what you have to say. Learn more

about running a test campaign.

WIKIBOARD

WikiBoard transforms Wikipedia browsing into an interactive, mind-map-like experience. Users can see connections between articles on a canvas, add notes, and explore topics like a connected web rather than a linear tab structure.

HOW TO DIAGNOSE AND FIX GOOGLE MAPS RANKING DROPS

Google Maps ranking drops are frequently linked to changes in SERP layouts, profile visibility signals, or competitor improvements. Businesses can use UTM parameters in GA4 and Search Console to isolate GBP traffic and identify affected keywords. Rank tracking grids and mobile SERP screenshots help determine if AI Overviews or ads have pushed down organic placements. Visibility gaps are often caused by outdated categories, low review activity, or pin locations falling outside city boundaries.

YOUTUBE EXPANDS VOICE REPLIES, SUPERCHAT GOALS AND AI CREATION TOOLS (7 MINUTE VIDEO)

YouTube is opening access to voice replies to millions of creators. The platform is also bringing the Create editing app to iOS and expanding Superchat Goals to vertical livestreams. Channel Guidelines are available to more channels, and new AI tools support image creation, auto dubbing controls, Shorts clip suggestions, and comment summaries. It is also testing changes to the Shorts dislike feature to better match viewer behavior.

GROWTH LESSONS BEHIND LOVABLE'S $6.6B VALUATION

Lovable reached a $6.6B valuation in 13 months due to relentless execution in a fast-growing AI category. It treats shipping velocity as the top priority to stay ahead. Lovable builds in public to create trust and turns community into a core growth engine as social becomes more powerful than search. It also uses aggressive freemium to drive usage and word of mouth.

GOOGLE'S AI USES SCHEMA?

Google Gemini may use structured data or hidden page content to ground AI search answers, but this has not been proven yet. Tests looked at 5 source pages and produced 101 content chunks. One sentence matched content from schema data and possibly hidden content, which raised questions about the true source. Clear proof of Gemini's scheme use requires pages where schema text and page text differ, so experts can see what it uses.

BUILDING LASTING BRAND EQUITY IN THE AGE OF AI

Cutting brand spend by $1 now requires $1.92 later to regain.

INSTAGRAM NOW LIMITS YOU TO FIVE HASHTAGS PER POST

Avoid spamming captions with irrelevant tags, as it could lower post performance.

CHATGPT BRINGS MAJOR UPDATE FOR IMAGE CREATION AND EDITING

ChatGPT's image tools now support more precise edits.

SPECIAL OFFER FOR TLDR >> 30% off through Dec 31

(Discount is for all Semrush One plans. Must be a new customer.)

TIKTOK SIGNS AGREEMENT TO CREATE NEW US JOINT VENTURE, MEMO SAYS

TikTok's US operations will soon be housed in a new joint venture named TikTok USDS Joint Venture LLC. The company has signed agreements with Oracle, Silver Lake, and Abu Dhabi-based MGX. The deal's closing date is on January 22. Oracle will serve as the 'trusted security partner' in charge of auditing and validating that TikTok complies with agreed-upon national security terms.

WARNER DEMANDS LARRY ELLISON'S PERSONAL GUARANTEE IN PARAMOUNT BID

Warner has urged shareholders to reject Paramount's hostile takeover bid due to concerns about the financing. Paramount is using an Ellison family trust to backstop the deal - Warner wants Larry Ellison to give a stronger personal guarantee that he is fully committed to the bid. Paramount isn't likely to raise its bid. Instead, it is engaging with shareholders and gathering feedback on its tender about what it needs to do.

THE INSIDE STORY OF SPACEX'S HISTORIC ROCKET LANDING THAT CHANGED LAUNCH FOREVER

SpaceX launched the Orbcomm-2 mission on an upgraded version of its Falcon 9 rocket on December 21, 2015. That night, the company landed the first stage for the first time. This article tells the inside story of the landing, starting with the disintegration of a Falcon 9 rocket in June 2015, the first time a Falcon 9 had been lost in flight.

TRUMP COMMITS TO MOON LANDING BY 2028, FOLLOWED BY A LUNAR OUTPOST TWO YEARS LATER

President Donald Trump signed an executive order outlining NASA's policy objectives for the next three years a couple of hours after a judge formally swore Jared Isaacman as the agency's administrator. The executive order states that the country must pursue a space policy that will extend the reach of human discovery, secure the nation's vital economic and security interests, unleash commercial development, and lay the foundation for a new space age. There are no concrete plans to send humans to Mars in the document. There's also a lack of reference to space science. An overview of the contents of the executive order is available in the article.

Get access to the course here.