The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.

🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulnerabi… #NodeJS #Security

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

the .env coming along got me man i lose an hour every laptop switch

Introducing the ASCII Library by ASCII Magic ✨ The biggest collection of animated ASCII/Halftone/Dither art: 634 pieces, 24 categories, all in one place. Scenes, cities, UI screens, charts, diagrams, 3D shapes, mascots, loaders, games, retro computers, science, explainers, music and more. What you can do with it: → Add one to your project in one prompt: run npx ascii-magic-art, browse every piece live in your terminal, press enter, paste into your coding agent → Restyle anything: halftone dots, real dither, ASCII, binary, letters, blocks, or your own characters → Embed it in 2 lines: one script tag + <ascii-art piece="matrix-rain"> → Works with React, Next.js, Vue, Svelte and Astro, or host it yourself → Use it as a wallpaper: 4K desktop, phone, YouTube, X header and LinkedIn banner sizes → Export GIF or video, ready for posts, emails and slides → Level up your GitHub README with GIFs and an animated banner maker → Build it into your interfaces: spinners, loaders, progress bars, empty states, 404 pages, dashboards Open source and MIT licensed. Use it anywhere, even in commercial work. 🔗 ascii-magic.com/ascii

Introducing tsrs: a Rust port of the TypeScript compiler 🦀 We are not forking TypeScript! ◆ In close collaborating with the TypeScript team ◆ Up to 8x faster than TS 7.0 & ~70% less memory ◆ Runs in WASM, so it works in your browser & on Workers ◆ Soon part of the Oxc toolchain npx tsrs blog.cloudflare.com/typescri…

my theory: best way to compete with a huge platform company is to optimize for a metric they can’t measure

Grok Bot is now one step closer. Set it as your iPhone's Action Button and press it to talk with Bot.

Today, Dream Labs is coming out of stealth with Dream-1, a robot foundation model that controls bimanual robots it has never seen, on tasks it was never shown, in places it has never been, from $3/hour. Dream API is live for everyone, today. 🧵

What’s one sound you’d give anything to hear again?

the weekend went pretty well: almost +200 followers for my 𝕏 GM and LFG!