Topic
Protecting a small business from fraud: scams, payment redirection, and the controls that stop them.
A misconfiguration left evaluation machines with live internet access, and two organisations both believed they were isolated. Outbound isolation is testable in under a minute, and most teams have never run the test.
The FTC, Utah and California say Hims shared health information with Meta and Snap through customer lists and automatic website Events. Four surfaces leak a category, and you can inspect all four in half an hour.
Amazon Threat Intelligence linked four npm compromises to a single state-backed actor, all of them starting with a socially engineered maintainer. The defence is not a scanner: it is four documented npm config options, and each one has a cost worth naming.
Phone verification stopped being an identity signal once controlling numbers at volume became a monthly expense. A cost-asymmetry table for signup controls at their published prices, our arithmetic at 10,000 signups a month, and Radar rules that connect the signal to the moment money moves.
Shared conversations and Artifacts turned up in search results this week. On a domain you do not own you cannot set a noindex tag, which leaves exactly two levers. Here are the operators to run and the revoke path for each surface.
Hugging Face says the intrusion started in a dataset loader and that public models are clean. The useful response is not panic: it is pinning every download to a full commit hash, scoping tokens per app, and refusing pickled weights.
New OAuth refresh tokens for the Google Ads API need a passkey from 5 August, and a new passkey takes one to two days to pair plus a possible seven-day trust delay. The arithmetic says create it today.
A DMARC record set to p=none tells receiving servers to do nothing at all. RFC 9989 also deleted the pct tag that most rollout guides still teach. Four stages, an exit criterion for each, and the exact record to publish.
The codex-security CLI is open source and gated to approved customers. Here is what a one-to-five person team can install this afternoon instead, with the free-tier limits and per-contributor costs that decide it.
A researcher typed a base path into a browser and got a directory listing of unguarded internal endpoints. The class of bug is OWASP API5, the most boring one there is, and the audit for it fits in an evening.
Published per-platform invalid traffic rates run from 7.57% on Google to 24.20% on TikTok. A five-step routine using clicks versus sessions, Google's 500-address IP exclusion limit, the Click Quality Form, and the spend level where a paid tool starts to pay for itself.
A report this week described the relay market that proxies frontier model access at a fraction of list price. The arithmetic says where the money comes from, and Anthropic's terms say who pays when a key leaks.
UK and US safety institutes watched an open-weight model finish a 32-step attack against weakly defended systems. A one-hour lockdown for small teams that run their own servers.
A researcher found a GitHub admin token, access to hundreds of repos, inside a camera's login page, put there by the build tool. The same failure mode lives in ordinary web builds; the fix takes an hour.
BEC cost victims $2.77 billion across 21,442 complaints in 2024 - roughly $129,000 per incident. It isn't a hacking problem; it's a payables-process problem, and the fix costs almost nothing.