标签：#hr

Imagine an HR manager who has just completed this month’s hiring drive. Dozens of candidates have accepted their offers, and everyone is eager to onboard them as quickly as possible. But before that can happen, every background verification request has to move through multiple checks, vendors, approvals, and status updates. What should be a straightforward operational process often turns into hours of chasing spreadsheets, checking vendor portals, and answering the same status questions over and over again. It isn’t a technology problem as much as it is a visibility problem — and that’s the challenge that inspired BGVerifyIQ. The problem every HR team quietly struggles with Ask any HR or Talent Acquisition team what happens after an offer letter goes out, and you’ll hear a familiar story. A candidate is selected. A background verification (BGV) request is raised with a vendor. And then… the waiting begins. Behind that wait is a surprising amount of manual work: HR has to log into multiple vendor portals just to check where a case stands. Status updates live in scattered Excel sheets, emails, and vendor dashboards that rarely agree with each other. Nobody has a single, live number for “how many candidates are actually ready to be approved today.” SLA breaches — cases that have been open too long — get discovered late, usually when a hiring manager complains. When a discrepancy or a “suspect” flag shows up, it can get buried in a spreadsheet row instead of being escalated immediately. Every time leadership asks “how are our BGV vendors performing,” someone spends half a day pulling numbers together manually. New joiners get onboarded before their verification is even reviewed properly, simply because nobody had a clear, current view of their case. None of this is because HR teams aren’t diligent. It’s because the tools weren’t built for this specific job. Spreadsheets don’t talk to vendor systems. Vendor portals don’t talk to each other. And nobody has time to become

I have a Medium account. I have an article. I have Chrome DevTools Protocol access to a logged-in Medium session. I spent two hours trying to get the article into Medium's editor. I failed. Here's exactly what happened and why. The setup Medium's story editor at medium.com/new-story has two contenteditable divs: one for the title, one for the body. No textareas, no inputs, no simple element.value = text . Contenteditable divs are rich text editors — you can't just set their content and expect the editor to recognize it. What I tried 1. innerHTML assignment const editor = document . querySelector ( ' [contenteditable="true"] ' ); editor . innerHTML = ' <p>My article text</p> ' ; editor . dispatchEvent ( new Event ( ' input ' , { bubbles : true })); The text appeared on screen. Medium showed it in the editor. But when I clicked "Publish", I got: "Something is wrong and we cannot save your story." The Publish button stayed disabled with the message "Publishing will become available after you start writing." Medium's editor uses a ProseMirror-like architecture. Setting innerHTML bypasses the editor's internal state model. The editor sees DOM changes but its internal document model doesn't update. It thinks the editor is empty even though text is visible. 2. document.execCommand('insertText') editor . focus (); document . execCommand ( ' selectAll ' ); document . execCommand ( ' delete ' ); document . execCommand ( ' insertText ' , false , articleText ); execCommand is deprecated but still works in most browsers. It's the approach most automation guides recommend for contenteditable elements. Medium's editor ignored it completely. The text didn't appear at all. execCommand('insertText') returns false — the command is not supported in this context. Medium's editor likely intercepts beforeinput events and prevents default for insertText input types, handling text insertion through its own transaction system instead. 3. CDP Input.insertText { "method" : "Input.insertText" ,

Trump’s secret reviews of frontier AI models may hide corruption, lawsuit says.

Most guides on choosing an applicant tracking system talk about features. This one is about the layer that actually determines whether the platform survives contact with your stack: integrations. If you're the technical person pulled into an ATS evaluation, this is the part your non-technical colleagues will underestimate — and the part that generates the most post-contract pain. Here's how to map it properly. 1. Inventory every data flow, not every tool Don't list “tools.” List directional data flows. For each system, write down what data moves, which direction, and how often: ●HRIS — candidate → employee record handoff on hire (bidirectional ideally) ●Payroll — new-hire data push (one-way, event-triggered) ●Background screening — order + status callback (bidirectional, webhook-driven) ●Calendar (Google/Microsoft) — interview scheduling + availability sync ●Video interview tools — scheduling links out, recordings/scores back ●Job boards / distribution — posting syndication out, application ingestion back The “direction + trigger” framing exposes gaps that a flat tool list hides. 2. Classify each integration by mechanism Not all “integrations” are equal. Push the vendor to tell you which of these each connection actually uses: ●Native pre-built integration — maintained by the vendor, lowest overhead ●Public REST API — you (or middleware) build and maintain it ●iPaaS / middleware (Workato, Merge.dev, etc.) — flexible, adds cost + a dependency ●Flat-file / SFTP batch — a red flag in 2025 for anything real-time ●“On the roadmap” — treat as does not exist A “yes, we integrate with X” that turns out to be a nightly CSV export is a very different thing from a webhook-driven bidirectional sync. 3. Interrogate the API itself If any integration will run through the public API, evaluate it like you'd evaluate any dependency: ●Is it REST/GraphQL, documented, and versioned? ●Rate limits — do they survive a high-volume hiring event? ●Webhooks for state changes, or are you stuck

Edelson PC is filing 30 new lawsuits against OpenAI over the Tumbler Ridge shooting, escalating claims to aiding and abetting and naming Chris Lehane, though evidence remains unconfirmed.

Anthropic says its newest AI models, Fable 5.1 and Mythos 5.1, address criticisms from customers about price, data retention, and overzealous safeguards. The company claims Claude Fable 5.1 offers stronger performance than Fable 5, but costs around 25 percent less typically and up to 45 percent less for complex agentic tasks, thanks to reduced pricing […]

Fable 5.1 includes changes meant to reduce token cost and false-positive restrictions from the model's safeguards.

New York's prestigious-yet-secretive venture firm Thrive Capital finally speaks out about its involvement in the messy drama upending international soccer.

OpenClaw has released OpenClaw 2.0, a major update to the open-source personal AI agent that changes its installation process, browser interface, memory, skills, automations, plugins, security, and collaboration features. By Daniel Dominguez

1. Overview Article Title : Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams Source : Unit 42 Published Date : 2026-08-31 Original Source : Unit 42 Related Sources : None Related Malware, Threat Groups, CVEs, Products : Spring Ring, PowerShell RAT, Microsoft Teams, Microsoft Quick Assist, Microsoft Edge, Active Directory Severity : High 2. Executive Summary Spring Ring uses external Teams accounts to impersonate corporate IT staff. It uses voice calls to trick targets into running RMM tools or custom malware. In advanced cases, the campaign attempts NTLM Relay against domain controllers using PetitPotam. 3. Attack Flow From External Teams Chat to Attempted Domain Privilege Escalation The attacker sets up an external onmicrosoft.com tenant and a display name to impersonate the IT department. The attacker sends a one-on-one Teams chat to the target, followed immediately by a voice call to build trust and urgency. In Campaign A, the attacker tricks the target into running an RMM tool like Quick Assist to enumerate devices and the domain. The attacker downloads an obfuscated PowerShell RAT, attempts to bypass AMSI, and connects to the C2 server. In Campaign B, the attacker delivers an executable file via an S3 URL tailored to the target, establishing persistence, a hidden Edge instance, and extensions. The attacker uses Python to scan internal TCP/445 and triggers NTLM authentication toward the domain controller. The attacker forces authentication using PetitPotam and attempts to gain domain privileges via NTLM Relay, though this was blocked in observed cases. 4. Attacker Positioning and Execution Location External attackers connecting to Teams from a Microsoft 365 external tenant. After running RMM or malware, the attacker reaches the internal network and Active Directory from the user device. 5. Victim and Administrator Visibility Victim Receives a chat and voice call on Teams from a display name that looks like internal IT staff, followed by

1. Basic Information Article Title : ServiceNow Patches 3 Critical Code Injection Vulnerabilities Source : SecurityWeek Publication Date : 2026-08-31 Original Article : SecurityWeek Related Sources : ServiceNow August 2026 CVE Advisory , BleepingComputer Related Malware, Threat Groups, CVEs, Products : CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876, ServiceNow AI Platform, Now Platform Severity : Critical 2. Executive Summary ServiceNow patched three unauthenticated CVSS 10.0 vulnerabilities—code injection in the GraphQL Composite Data API, an access control flaw in configuration image upload processing, and SQL injection in dynamic schema ORDER BY clauses—along with an unauthenticated sandbox escape in the ServiceNow AI Platform. 3. Attack Flow From Unauthenticated Request to Instance Compromise An attacker sends a crafted request to an externally accessible ServiceNow AI Platform. CVE-2026-18885 causes code injection in the GraphQL Composite Data API. CVE-2026-18886 exploits an access control flaw in configuration image upload processing to create and modify data and escalate privileges. CVE-2026-74820 injects SQL into dynamic ORDER BY clauses to manipulate the underlying database. CVE-2026-6876 escapes the sandbox to execute code within the Now Platform. Successful exploitation can spread to instance data, integration credentials, approval workflows, and external systems. Active exploitation is not observed. 4. Attacker Position and Execution Context An unauthenticated external attacker with network access to the HTTP(S) endpoint of the ServiceNow instance. Operates with the privileges of the Now Platform or the underlying database upon successful exploitation. 5. Visibility for Victims and Administrators Victims Because exploitation requires no user interaction, it may appear on the screen as unauthorized changes to data, settings, permissions, or approval workflows. Administrators Clues include abnormal GraphQL requests, configuration image uploa

1. Basic Information Article Title : Microsoft warns of TerminalFix attacks deploying reverse tunnels Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Source : Microsoft Security Research Related Malware / Threat Groups / CVEs / Products : TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active Directory Severity : High 2. Executive Summary TerminalFix uses a fake Cloudflare CAPTCHA on compromised websites to trick users into pasting PowerShell commands. It then performs DLL side-loading, extracts payloads from PNG images, establishes dual persistence, and enumerates Active Directory to set up a reverse WebSocket tunnel that reaches the internal network. 3. Attack Flow From Fake CAPTCHA to Network Pivot Point A compromised website displays a fake Cloudflare Turnstile page and copies malicious PowerShell code to the clipboard. The user pastes the code into the terminal, extracting a ZIP file to C:\ProgramData and executing 1.bat . The legitimate LockScreenContentServer.exe side-loads a malicious dui70.dll . PowerShell restores the executable and DLL fragments from three PNG images. The infection creates a Run key and a 60-minute scheduled task, then hides the folder. It enumerates Active Directory and internal servers, setting up a file-monitoring command execution loop. It deploys the Python runtime and client.py to relay arbitrary TCP traffic from the external C2 to internal targets over a TLS WebSocket. 4. Attacker Position and Execution Location External attackers direct victims to view compromised websites. After execution, the compromised endpoint is operated as a pivot point between the external C2 and the internal network. 5. Visibility for Victims and Administrators Victims Tricked into opening the terminal from a realistic Cloudflare verification screen and pasting multi-line verification commands. Administrators Observable indicators include random-name fo

1. Overview Title : Chinese Fire Ant hackers turn Cisco routers into spying platforms Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Sources : Sygnia Related Malware, Threat Groups, CVEs, Products : Fire Ant, BridgeAgent, TacTap, Medusa rootkit, Cisco IOS XR, TACACS+, Linux, Zabbix Severity : High 2. Executive Summary Fire Ant compromised Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. The actors used GRE tunnels, suppressed logs and CLI outputs, captured network traffic, stole credentials, and deployed multiple long-term backdoors to explore connected high-value networks. 3. Attack Flow Turning Trusted Management Infrastructure into Relay Points Fire Ant gains high-privileged access to Cisco IOS XR routers and Linux management hosts. The initial access vector is not disclosed. The actors place persistence scripts and IOS XR-specific components on the routers, manipulating syslog and show outputs. They operate GRE tunnels with VRF and outbound Telnet connections that rarely appear in configurations or history logs. They capture network traffic into PCAP files on the routers and send them to external FTP servers to gather internal network topology and authentication flows. They deploy BridgeAgent, rootkits, custom SSH, and packet-triggered backdoors on the GRE-connected Linux hosts. They inject libraries into tac_plus using TacTap to harvest TACACS credentials. They probe connected SSH, HTTP(S), SMB/RPC, and RDP services to verify reachability to high-value networks, including critical infrastructure. 4. Threat Actor Positioning and Execution Environment External actors with high-privileged access to routers, TACACS servers, and Linux management hosts. The initial access vector is unknown. After the compromise, they explore connected target networks from inside organizational interconnections and management paths. 5. Visibility for Victims and Administrators Victims The activity r

Lawsuit: Anthropic’s torrenting totally screwed songwriters as AI songs top charts.

An extension can work perfectly in development and still fail after packaging. The risky change is often not in the feature code itself. It can be a permission that moved, a host pattern that expanded, a content script that now runs somewhere new, or a browser surface that was never included in the release checklist. Here is the small preflight review I now use before testing an MV3 release. 1. Compare the packaged manifests Compare the last version you actually shipped with the new packaged version, not only the source manifest. Check separately: required permissions; optional permissions; required host access; optional host access. A permission moving from optional to required deserves attention even if the set of permission names looks familiar. 2. List every browser surface Turn the manifest into a list of things a person can interact with or that Chrome can start: action popup; options page; side panel; background service worker; content scripts; commands; externally connectable pages; declarative network rules; web-accessible resources. If a surface changed, add at least one release check for it. This sounds obvious, but it is easy to review the main popup while forgetting an options page or a host-specific content script. 3. Check where code can now run For every content script, compare: match patterns; excluded matches; frames; execution world; run timing. The JavaScript file can be unchanged while one of these settings changes the extension's behavior on real sites. 4. Test the packaged build Run the checklist against the same build directory that will be uploaded. A development build can hide packaging, path, minification, or generated-manifest differences. At minimum, reload the packaged extension and exercise one path through each changed surface. 5. Record why each check exists Instead of keeping a generic list such as “test the popup,” connect each check to a release change: host access expanded → test the new host and confirm the old hosts still

This latest lawsuit is particularly broad and homes in on accusations of illegal piracy.

Given 10 benchmarks for specific misaligned behaviors, the automated systems were able to improve performance on every single one without degrading overall performance.

Caricare un’estensione da disco, aprirne il popup e automatizzare verifiche UI: un workflow più completo per chi sviluppa estensioni e usa agenti. Sviluppare un’estensione Chrome oggi significa spesso alternare tre modalità: codice “a mano”, generazione assistita da un coding agent e una fase di verifica nel browser che resta comunque imprescindibile. Il problema è che molti agenti riescono ad aprire pagine e cliccare elementi, ma si fermano quando entrano in gioco le estensioni: installazione, gestione del popup, interazioni con la UI dell’estensione, verifica rapida dei cambiamenti. Chrome DevTools for agents colma proprio quel vuoto: aggiunge al set di strumenti dell’agente la possibilità di installare e pilotare un’estensione durante i test, oltre a renderne più pratico il debugging. Quando è davvero utile Ci sono alcuni scenari tipici in cui il supporto “estensioni-aware” fa la differenza: Ciclo di feedback più rapido : compili/packi l’estensione, la carichi in Chrome e verifichi subito il popup o una content script UI. Test end-to-end più realistici : invece di simulare una UI in una pagina fittizia, testi l’estensione nel suo contesto reale (action popup, permessi, storage, ecc.). Validazione automatizzata : l’agente può controllare che l’estensione si installi correttamente, che il popup si apra e che i componenti principali siano presenti e interagibili. In pratica: se il tuo agente sa “guidare” il browser ma non sa “gestire” le estensioni, la qualità del test rimane limitata. Setup: abilitare esplicitamente gli strumenti per le estensioni Un dettaglio importante: per ragioni di sicurezza e controllo (in particolare per l’uso dei token e del contesto in cui operano gli agenti), le funzionalità specifiche per estensioni non sono abilitate di default . Dopo aver installato Chrome DevTools for agents, serve quindi un passaggio esplicito nella configurazione MCP: individua il tuo file di configurazione MCP ; abilita la categoria dedicata alle estensioni aggiung

Anthropic refused to support lethal autonomous warfare and mass surveillance.

A federal judge ruled the Trump administration illegally labeled Anthropic a supply chain risk, handing the AI company a victory as its second Pentagon lawsuit continues in Washington.