Expect bumps with X Money rollout as major US financial markets are excluded.

OpenAI is giving 100,000 academic researchers free access to ChatGPT's most advanced AI models to accelerate scientific research, collaboration, and discovery.

Startup Zanskar has created one of the most productive geothermal wells in the US at a power plant that had been in decline for years.

Cisco Talos IR Q2 2026: Observed Attack Chains of M365 Token Compromise and RMM-Disguised Ransomware 1. Basic Information Article Title : IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains Publisher : Cisco Talos Blog Publication Date : July 28, 2026 Original Article : https://blog.talosintelligence.com/ir-trends-q2-2026/ Related Sources : ARToken technical analysis and Talos IR observations within the article Related Entities : UAT-11764, ARToken, EvilTokens, Sinobi, Warlock/Storm-2603, MeshAgent/MeshCentral, Zoho Assist, Microsoft 365, SharePoint, OneDrive, RDP, WinRM, rclone Severity : High 2. Executive Summary Talos IR identified real-world attack chains from recent incidents. The first chain steals M365 tokens using QR code PDFs and OAuth device-code phishing, then self-propagates through inbox rules, SharePoint, and mass internal emails. The second chain uses modified and abused legitimate RMM tools to achieve SYSTEM persistence, lateral movement, and domain-wide ransomware deployment via GPO. 3. Attack Flows Chain A: UAT-11764 QR Phishing The attacker sends targeted PDFs from a compromised M365 account. The victim scans the PDF's QR code using a mobile device. Credentials are stolen on a fake M365 login page. The attacker signs in to the Microsoft account. Inbox rules are created to hide warnings and replies. Malicious documents are placed in SharePoint. The attacker uses contacts to resend phishing emails internally and externally. Chain B: M365 Token Compromise via ARToken Lures pretending to be trusted vendors are presented. The user is redirected to the Microsoft OAuth device authorization flow. The user approves the attacker's device code on a legitimate Microsoft screen. Access tokens are obtained without stealing passwords, bypassing MFA. ARToken manages tokens using over 80 APIs. Persistence is achieved via PRT, followed by email/BEC, inbox rule manipulation, and OneDrive/SharePoint management and exfiltration. Toke

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars 1. Basic Information Article Title : Unpatched Fastjson Vulnerability Exploited in Attacks Publisher : SecurityWeek Publication Date : July 28, 2026 Original Source : https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/ Related Sources : Alibaba Security Advisory: https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 Imperva: https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/ FearsOff Technical Analysis: https://fearsoff.org/research/fastjson-1-2-83-rce Related Entities : CVE-2026-16723, Fastjson 1.2.68 to 1.2.83, Spring Boot executable fat-jar, Alibaba, Imperva, ThreatBook Severity : Critical 2. Summary This is an actively exploited vulnerability in end-of-life Fastjson 1.x used within Spring Boot fat-jars. If an attacker sends a crafted JSON request without authentication, it can reach remote code execution (RCE) with Java process permissions via external resource lookups, even when AutoType is not explicitly enabled. 3. Attack Flow The attacker scans for publicly exposed JSON-receiving endpoints. The attacker sends a crafted JSON payload containing @type . Fastjson 1.x type resolution logic treats the @JSONType annotation as a trust signal. The application bypasses AutoType restrictions and triggers a lookup to an attacker-controlled resource. Vulnerable Spring Boot fat-jar configurations reach the code execution path without external gadgets. Arbitrary code runs with the execution permissions of the Java application user. Inference : The attack may proceed to drop webshells, search for credentials, access cloud metadata, and deploy lateral movement tools. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet or an accessible internal network. The vulnerability is processed by

ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration 1. Basic Information Article Title : Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026) Source : JVN Publication Date : July 28, 2026 Original URL : https://jvn.jp/jp/JVN56870912/index.html Related Source : ELECOM Notice (Linked from JVN) Related Entities : CVE-2026-44387 (Reflected XSS) CVE-2026-59764 (Management Screen OS Command Injection) CVE-2026-61376 (Configuration Restoration OS Command Injection) WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B Severity : Medium 2. Executive Summary An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network. 3. Attack Flow Chain A: Attacker Already Has Administrator Credentials The attacker reaches the management screen. The attacker logs in as an administrator. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376. Arbitrary commands execute on the device OS. Inference : Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion. Chain B: Reflected XSS An attacker on the same or an adjacent network prepares a crafted URL. The attacker tricks a user who can access the management screen into opening the URL. A script executes in the management screen origin via CVE-2026-44387. Inference : If a management session exists, it may chain into unintended management actions. 4. Attacker Position and Execution Location XSS requires adjacent network reachability and user interact

vBulletin CVE-2026-61511: Unauthenticated RCE via Public AJAX Template to eval() 1. Basic Information Article Title : vBulletin fixes critical pre-auth RCE flaw with public exploit Publisher : BleepingComputer Publication Date : July 28, 2026 Original URL : https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/ Related Sources : NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61511 Researcher Technical Analysis: https://karmainsecurity.com/ SSD Secure Disclosure: https://ssd-disclosure.com/ Related Entities : CVE-2026-61511, vBulletin 5.x/6.x, vB5_Template_Runtime::runMaths() , ajax/render/pagenav , phpfuck Severity : High 2. Executive Summary Sending a crafted pagenav[pagenumber] to vBulletin's public AJAX template rendering bypasses the weak validation of the math function runMaths() using phpfuck. It reaches PHP's eval() without authentication to execute arbitrary code. A public PoC with a known fix exists, and scanning activity is expected to increase. 3. Attack Flow The attacker searches for public sites running vBulletin 5.x/6.x. They send a request to a public template rendering endpoint like ajax/render/pagenav . They insert a PHP expression into pagenav[pagenumber] to bypass math validation. Template execution reaches vB5_Template_Runtime::runMaths() . The input goes to PHP eval() , executing arbitrary PHP code. OS commands start under the PHP/web server user permissions. Inference : Leads to web shell installation, database credential theft, forum database exfiltration, defacement, and persistence. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet without authentication. The vulnerable processing happens inside the vBulletin template runtime. PHP code runs with Web/PHP-FPM/Apache user permissions. 5. Visibility for Victims and Administrators No user action or login is needed. Web access logs may show ajax/render/pagenav and an unusual pagenumber parameter

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking 1. Basic Information Article Title : Over 24,000 exposed server BMCs leak password hash via decades-old flaw Publisher : BleepingComputer Publication Date : July 28, 2026 Original Source : https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ Related Sources : Lava research (linked in original), CVE-2013-4786 Related Entities : CVE-2013-4786, IPMI 2.0, BMC, Supermicro, HPE iLO 4, UDP/623, GPU/AI servers Severity : High 2. Executive Summary Attackers can send an authentication request to exposed IPMI/BMC interfaces on the internet and receive a password-derived response. They can crack this response offline using GPUs to gain server management privileges that sit below the operating system. A recent scan found 24,650 devices leaking authentication material, with 2,340 using weak, dictionary-based administrator passwords. 3. Attack Flow Scan the internet for IPMI 2.0 services on UDP/623. Start an RMCP+/RAKP authentication handshake with the BMC. Obtain the password-derived authentication response without credentials. Perform offline cracking using dictionaries, default ADMIN users, and vendor-generated password rules. Log in to the BMC using the recovered password. Control power, virtual media, firmware, and low-level settings. Reuse the same credentials on other management interfaces. Inference : Use virtual media or boot settings to compromise the OS, establish persistence, and move laterally across the management network. 4. Attacker Position and Execution Location Attackers connect to UDP/623 from the internet or a reachable management network. Hash cracking happens on the attacker's GPU/CPU, avoiding failed login alerts on the target system. Post-compromise actions run on the BMC processor, which is independent of the OS. 5. Visibility for Victims and Administrators The OS, EDR, and host logs may not show

Local push-to-talk dictation for Mac Discussion | Link

Handling Asynchronous Webhook Notifications & Callbacks in Joget via BeanShell When integrating Joget DX with external platforms—such as payment gateways, SMS providers, or ERP systems—requests are often processed asynchronously. The external system accepts a request immediately and dispatches an HTTP POST webhook callback to Joget minutes or hours later when processing completes. Receiving webhook callbacks inside BeanShell API endpoints requires two key tasks: Safe Variable Type Coercion: Handling parameter arrays ( String[] ) versus single strings ( String ) safely without throwing ClassCastException . FormDataDao Persistence: Saving or updating the notification payload inside a Joget form database table using FormDataDao . In this guide, we'll write a defensive Java/BeanShell script that receives asynchronous webhook callbacks and logs them cleanly into Joget. Architecture Overview Webhook Endpoint: An external system hits your Joget API endpoint with callback parameters (e.g. process_id , status , response_payload , recipient ). Type Extraction: A safe helper function handles parameter type variations (whether passed via URL query params or JSON request bodies). FormDataDao Save: Instead of executing raw JDBC queries, the script uses FormDataDao to persist a FormRowSet directly into Joget's form storage engine. The BeanShell Script Place this code inside your API Builder BeanShell script or custom REST endpoint: import org.joget.apps.app.service.AppUtil ; import org.joget.apps.form.dao.FormDataDao ; import org.joget.apps.form.model.FormRow ; import org.joget.apps.form.model.FormRowSet ; import org.joget.commons.util.LogUtil ; import java.util.UUID ; // 1. Safe Type Extraction Helper public String safeExtract ( Object param ) { if ( param == null ) return "" ; try { if ( param instanceof String []) { String [] arr = ( String []) param ; return arr . length > 0 ? arr [ 0 ] : "" ; } if ( param instanceof String ) { return ( String ) param ; } } catch ( Throwable t

Generating Multilingual HTML Reports with Attachment Download Links in Joget Creating customized executive report summaries in Joget DX often requires more than simple database lists. Real-world business reports frequently need to join multiple tables, translate status labels based on the user's active locale ( #platform.currentLocale# ), and generate secure file download links for form attachments. In this guide, we'll build a Java/BeanShell script that queries main records and history logs, resolves internationalization ( i18n ) message keys dynamically, and generates interactive HTML reports embedded with secure attachment links. Key Components Dynamic i18n Translation: Uses AppUtil.processHashVariable("#i18n.key#", null, null, null) to convert database status codes into localized text matching the user's language setting. File Attachment Links: Formats secure file download URLs ( /jw/web/client/app/{appId}/{version}/form/download/{tableName}/{recordId}/{fileName} ) so users can open uploaded documents directly from the report summary. Multi-Table SQL Join: Merges main request details, audit transaction history, and custom review tables into a clean HTML document layout. The BeanShell Script Place this code inside a BeanShell Form Bounding Box or an HTML Report Generator tool step: import java.sql.Connection ; import java.sql.PreparedStatement ; import java.sql.ResultSet ; import java.net.URLEncoder ; import javax.sql.DataSource ; import org.joget.apps.app.service.AppUtil ; import org.joget.apps.app.model.AppDefinition ; import org.joget.commons.util.LogUtil ; // Helper: Resolve i18n hash variables dynamically public String getLocalizedText ( String messageKey ) { if ( messageKey == null || messageKey . isEmpty ()) return "" ; String hashVariable = "#i18n." + messageKey + "#" ; return AppUtil . processHashVariable ( hashVariable , null , null , null ); } String recordId = "#requestParam.id#" ; if ( recordId == null || recordId . trim (). isEmpty ()) { return "<di

If you've ever used an online PDF tool, you know the routine. You need to merge two files. You find a site. You upload. Then: "Sign in to download." "Free plan: 2 tasks per day." "Your result is ready — with our watermark on it." "Upgrade to remove limits." A five-second job turns into an account, a countdown, and a branded output you can't send to a client. That's the friction that made me build PDFKing — 23 PDF tools in one place, with none of the catches. No sign-up. No watermarks. No daily limits. Nothing to install. The Problem With Most "Free" PDF Tools "Free" almost always has a shape: Free tier, capped at a couple of tasks a day Sign-in wall before you can download Watermark on the output unless you pay File-size limits that push you to a premium plan None of that is about the PDF. It's about converting a person in a hurry into an account. I wanted the opposite: open the tool, do the job, close the tab. No relationship required. The Approach A few principles shaped everything: Every common PDF job in one place — no bouncing between five single-purpose sites Name tools by what they do , not by how the code works Same short flow for all of them — pick, add file, run, download Nothing gatekept — no login, no watermark, no per-day counter What's Actually In It 23 tools, grouped by what you're trying to do. Organise & optimise Merge, Split, Compress, Organise pages, Delete pages, Extract pages, Rotate, plus an Image Compressor for JPG/PNG/WEBP. Convert to & from PDF PDF to Word, Word to PDF, HTML to PDF, JPG to PDF, PDF to JPG, PDF to Text. Secure & sign Watermark, Sign, Redact, Protect (password), Unlock. Edit Crop, Add page numbers, Edit PDF (text, shapes, highlights, annotations), Edit metadata. The ones people hit first: Merge PDF , Compress PDF , PDF to Word , and Sign PDF . Privacy Isn't a Feature, It's the Default With PDFKing: there's no account, so there's nothing to log against you [confirmed on site] there's no watermark added to anything you make [con

How to Update Joget App Environment Variables Programmatically in BeanShell In Joget DX, App Environment Variables are commonly used to store global configuration values—such as API endpoints, tax rates, batch counter sequences, or feature flags. While administrators can update these variables manually through Joget App Center, enterprise workflows often need to update environment variables programmatically (for example, incrementing a daily batch sequence counter or updating an OAuth access token). In this guide, we'll write a short BeanShell script using Joget's EnvironmentVariableDao to fetch and update App Environment Variables dynamically. How It Works Obtain App Context: AppUtil.getCurrentAppDefinition() retrieves the active application definition. Access the DAO Bean: AppUtil.getApplicationContext().getBean("environmentVariableDao") retrieves Joget's internal DAO for environment variables. Load & Update: environmentVariableDao.loadById(envVarId, appDef) retrieves the target variable instance. Modifying .setValue() and executing environmentVariableDao.update(envVar) persists the updated value immediately. The Code Place this BeanShell snippet inside a BeanShell Tool workflow step or a Form Post-Processing Tool : import org.joget.apps.app.dao.EnvironmentVariableDao ; import org.joget.apps.app.model.AppDefinition ; import org.joget.apps.app.model.EnvironmentVariable ; import org.joget.apps.app.service.AppUtil ; import org.joget.commons.util.LogUtil ; public void updateAppEnvironmentVariable ( String variableId , String newValue ) { AppDefinition appDef = AppUtil . getCurrentAppDefinition (); if ( appDef != null ) { // Retrieve Joget's Environment Variable DAO bean EnvironmentVariableDao envDao = ( EnvironmentVariableDao ) AppUtil . getApplicationContext (). getBean ( "environmentVariableDao" ); // Load target environment variable by ID EnvironmentVariable envVar = envDao . loadById ( variableId , appDef ); if ( envVar != null ) { LogUtil . info ( "EnvVar Manager

Custom Cell Renderers & Action Buttons in Joget Spreadsheet Elements The built-in Spreadsheet Element in Joget DX provides a spreadsheet-like interface for managing tabular records inside forms. However, standard spreadsheet columns only support basic text or dropdown inputs out of the box. If you want to add row-level action buttons (like a Delete Row button) or turn plain cell text into an interactive Modal Popup Link , you can supply custom Handsontable renderer functions directly inside your Spreadsheet column properties. In this guide, we'll look at two practical examples: adding a custom row-deletion button and rendering interactive drill-down links. Example 1: Adding a Custom Delete Row Button In your Joget Spreadsheet element, open column properties for an action column and configure the custom renderer function below: {{ renderer : function ( instance , td , row , col , prop , value , cellProperties ) { // Render custom HTML button inside the cell td . innerHTML = " <button type='button' class='btn-delete-row'>Delete</button> " ; td . style . textAlign = " center " ; // Attach click handler to remove the target row from the Handsontable instance const btn = td . querySelector ( " .btn-delete-row " ); btn . onclick = function ( e ) { e . preventDefault (); e . stopPropagation (); // Get underlying Handsontable instance from the form field const hotInstance = FormUtil . getField ( " your_spreadsheet_field_id " ). data ( " hot " ); if ( hotInstance ) { hotInstance . alter ( " remove_row " , row ); } }; } }} Key Highlights: instance.alter("remove_row", row) removes the target row directly from the underlying data model. e.stopPropagation() prevents Handsontable from entering cell-edit mode when the button is clicked. Example 2: Interactive Drill-Down Popup Links To display a clickable link in a grid cell that opens a detailed record inside a Joget modal dialog (popup iframe), use this cell renderer: {{ renderer : function ( instance , td , row , col , prop , va

Russia’s conflict with Telegram is no longer limited to blocking attempts, fines or demands to remove content. On July 29, Russia’s Federal Security Service said it had charged Telegram founder Pavel Durov with aiding terrorist activity and placed him on an international wanted list. The FSB claims Telegram failed to remove channels, chats and bots allegedly used by Ukrainian intelligence services and extremist groups to coordinate attacks, sabotage and cybercrime inside Russia. Those are allegations made by Russian authorities. They have not been established by a court. That distinction matters, especially with a story moving this quickly. What has actually been confirmed Both Reuters and the Associated Press report that the FSB announced formal charges and an international wanted listing. What has not been publicly confirmed is an Interpol Red Notice. The terms are often treated as interchangeable in breaking-news coverage, but they are not the same thing. Interpol describes a Red Notice as a request for police worldwide to locate and provisionally arrest a wanted person. It is not an international arrest warrant, and each country decides what legal action it can take. That does not make the Russian case insignificant. It simply means developers, writers and users should avoid adding legal conclusions that the available evidence does not support. Moderation is part of the architecture The case is political, but the problem underneath it is familiar to anyone building a platform around user-generated content. Moderation is often described as a policy issue. In practice, much of it depends on product and engineering decisions: Can users report a specific message, account, bot or channel? Is there enough context for a moderator to review the report? Can repeated reports be grouped rather than handled separately? Are enforcement decisions logged? Can a decision be appealed? Who can access user information during an investigation? How are government requests received,

We need to talk about the way we launch products, because right now, the architecture is fundamentally flawed. Launching on the standard major platforms today is the marketing equivalent of renting RAM. You get a massive spike in resources on Day 1, it looks amazing on your dashboard, but by Day 30, the garbage collector comes along and wipes your traffic back to zero. I recently dug into the analytics of 2026 SaaS launches, and the reality is brutal: a directory launch is just borrowed reach. You are renting a platform's homepage for 24 hours. Worse, the ecosystem has become a pay-to-win script. Funded startups are paying "launch agencies" $2,000+ to optimize their assets, schedule their upvotes, and game the leaderboards. As solo developers, we don't need a 24-hour spike. We need persistent state . We need SEO and dofollow backlinks. A backlink from a high Domain Authority site compounds over time. A "Product of the Day" badge is just /dev/null a week later. I got so annoyed by this that I started hacking on a concept called Flamas (flamas.io) to see if a "backlinks over badges" model could actually work. The idea is to build a daily board that rewards genuine maker upvotes with permanent SEO value, rather than just a 24-hour traffic burst. But I’m stuck on the system design and need your ideas: If you were building a community-driven launch board from scratch, how would you design the ranking algorithm? What parameters or rate-limits would you use to ensure it stays fair for solo devs and bulletproof against paid bot agencies? Drop your logic in the comments. I’m treating this as an open whiteboard and want to build the solution based on how actual founders think. 👇

We like to think of our home as a nice, smooth sphere. But mapping the Earth’s gravitational field provides a different view of the planet.